F-13114 adjustment to AES-CBC autosar output length

wolfcrypt/src/port/autosar/README.md

@@ -28,10 +28,18 @@ CSM_UNSUPPORTED_ALGS with no driver implementation:
 
 Two deviations worth noting:
 
-- resultLengthPtr is in/out in the AutoSAR specification, but this port never
-  writes back through it for encrypt or decrypt. For CBC the output length
-  equals the input length. Csm_RandomGenerate reads it as the number of bytes
-  wanted and likewise does not update it. Csm_MacGenerate does update it.
+- resultLengthPtr is in/out, as the AutoSAR specification defines it, for
+  Csm_Encrypt and Csm_Decrypt (and their WithKey variants). Before every call
+  that includes UPDATE (SINGLECALL included) set it to the space available at
+  resultPtr; it must not be NULL. If that is less than dataLength the call
+  fails with E_SMALL_BUFFER (CSM_E_SMALL_BUFFER), nothing is written, and the
+  job is released, so start it again. On success it is replaced with the number
+  of bytes produced, which for CBC equals dataLength. Do not reuse the value
+  returned by one call as the capacity for the next without resetting it. A call
+  without UPDATE produces nothing making resultLengthPtr be 0.
+  The deviation is Csm_RandomGenerate, which reads resultLengthPtr as the
+  number of bytes wanted and does not update it. Csm_MacGenerate does update
+  it.
 - MAC lengths: Csm_MacVerify's macLength is in BITS, as the specification
   defines it, and Csm_MacGenerate's macLengthPtr is in BYTES. The asymmetry is
   the specification's, not this port's invention, but it is a footgun: passing

wolfcrypt/src/port/autosar/crypto.c

@@ -1016,6 +1016,7 @@ Std_ReturnType wolfSSL_Crypto_CBC(Crypto_JobType* job)
     if ((job->jobPrimitiveInputOutput.mode & CRYPTO_OPERATIONMODE_UPDATE)
             != 0) {
         Aes* aes = GetAesStruct(job);
+        uint32* outLen = job->jobPrimitiveInputOutput.outputLengthPtr;
 
         if (aes == NULL) {
             WOLFSSL_MSG("Error finding AES structure");
@@ -1026,6 +1027,28 @@ Std_ReturnType wolfSSL_Crypto_CBC(Crypto_JobType* job)
          * to send a FINISH, and leaving the slot claimed would both leak it
          * and leave a stale context for the next START with this jobId. A
          * named key the device will not handle fails exactly here. */
+
+        /* outputLengthPtr holds the size of the output buffer on the way in
+         * and the number of bytes produced on the way out */
+        if (job->jobPrimitiveInputOutput.outputPtr == NULL || outLen == NULL) {
+            WOLFSSL_MSG("No output buffer for AES-CBC");
+            (void)FreeJobSlot(job);
+            return E_NOT_OK;
+        }
+
+        if ((job->jobPrimitiveInputOutput.inputLength % WC_AES_BLOCK_SIZE)
+                != 0) {
+            WOLFSSL_MSG("AES-CBC input is not a multiple of the block size");
+            (void)FreeJobSlot(job);
+            return E_NOT_OK;
+        }
+
+        if (*outLen < job->jobPrimitiveInputOutput.inputLength) {
+            WOLFSSL_MSG("AES-CBC output buffer is too small");
+            (void)FreeJobSlot(job);
+            return E_SMALL_BUFFER;
+        }
+
         if (encrypt == AES_ENCRYPTION) {
             if (wc_AesCbcEncrypt(aes, job->jobPrimitiveInputOutput.outputPtr,
                     job->jobPrimitiveInputOutput.inputPtr,
@@ -1044,6 +1067,11 @@ Std_ReturnType wolfSSL_Crypto_CBC(Crypto_JobType* job)
                 return E_NOT_OK;
             }
         }
+        *outLen = job->jobPrimitiveInputOutput.inputLength;
+    }
+    else if (job->jobPrimitiveInputOutput.outputLengthPtr != NULL) {
+        /* START and FINISH produce no output of their own. */
+        *job->jobPrimitiveInputOutput.outputLengthPtr = 0;
     }
 
     if ((job->jobPrimitiveInputOutput.mode & CRYPTO_OPERATIONMODE_FINISH)
@@ -1207,8 +1235,7 @@ Std_ReturnType wolfSSL_Crypto_CMAC(Crypto_JobType* job)
             }
             else {
                 XMEMCPY(job->jobPrimitiveInputOutput.outputPtr, tag, tagSz);
-                /* unlike the cipher services, MAC generate does report the
-                 * length produced */
+                /* report the length produced, as the cipher services do */
                 *outLen = tagSz;
             }
         }