Return BAD_ALIGN_E from init for misaligned contexts on x86_64

.wolfssl_known_macro_extras

@@ -863,6 +863,7 @@ WC_MPFS_ATHENA_NO_BASE_ADDR
 WC_MPFS_ATHENA_NO_HW_INIT
 WC_MPFS_ATHENA_NO_HW_MUTEX
 WC_NO_ASYNC_SLEEP
+WC_NO_CTX_ALIGN_CHECK
 WC_NO_RNG_SIMPLE
 WC_NO_STATIC_ASSERT
 WC_NO_VERBOSE_RNG
@@ -1442,6 +1443,7 @@ __SDCC_VERSION_PATCH
 __SIZEOF_INT128__
 __SIZEOF_LONG_LONG__
 __SIZEOF_LONG__
+__STDC_HOSTED__
 __STDC_NO_ATOMICS__
 __STDC_VERSION__
 __STDC__

doc/dox_comments/header_files/aes.h

@@ -787,6 +787,8 @@ int  wc_AesCcmDecrypt(Aes* aes, byte* out,
     wc_AesXtsFree on aes key when done.
 
     \return 0 Success
+    \return BAD_ALIGN_E On x86_64, if aes is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param aes   AES keys for encrypt/decrypt process
     \param heap  heap hint to use for memory. Can be NULL
@@ -1093,6 +1095,8 @@ int wc_AesXtsFree(XtsAes* aes);
     with async hardware. It is up to the user to call wc_AesFree on the Aes
     structure when done.
     \return 0 Success
+    \return BAD_ALIGN_E On x86_64, if aes is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param aes aes structure in to initialize
     \param heap heap hint to use for malloc / free if needed
@@ -3617,6 +3621,8 @@ int wc_AesGetKeySize(Aes* aes, word32* keySize);
     \return BAD_FUNC_ARG If aes is NULL, or if id is NULL while len is
     positive.
     \return BUFFER_E If len is negative or greater than AES_MAX_ID_LEN.
+    \return BAD_ALIGN_E On x86_64, if aes is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param aes pointer to the AES structure to initialize
     \param id pointer to the ID buffer
@@ -3654,6 +3660,8 @@ int wc_AesInit_Id(Aes* aes, unsigned char* id, int len, void* heap,
 
     \return 0 On success.
     \return BAD_FUNC_ARG If aes or label is NULL.
+    \return BAD_ALIGN_E On x86_64, if aes is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param aes pointer to the AES structure to initialize
     \param label pointer to the null-terminated label string

doc/dox_comments/header_files/curve25519.h

@@ -148,6 +148,8 @@ int wc_curve25519_shared_secret_ex(curve25519_key* private_key,
     \return 0 Returned on successfully initializing the curve25519_key
     structure.
     \return BAD_FUNC_ARG Returned when key is NULL.
+    \return BAD_ALIGN_E On x86_64, if key is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param [in,out] key Pointer to the curve25519_key structure to initialize.
 
@@ -968,6 +970,8 @@ int wc_curve25519_make_priv(WC_RNG* rng, int keysize, byte* priv);
 
     \return 0 On successfully initializing the key
     \return BAD_FUNC_ARG If key is NULL
+    \return BAD_ALIGN_E On x86_64, if key is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param key Pointer to the curve25519_key structure to initialize
     \param heap Pointer to heap hint for memory allocation (can be

doc/dox_comments/header_files/ed25519.h

@@ -528,6 +528,8 @@ int wc_ed25519ph_verify_msg(const byte* sig, word32 siglen, const byte* msg,
 
     \return 0 Returned upon successfully initializing the ed25519_key object.
     \return BAD_FUNC_ARG Returned if key is NULL.
+    \return BAD_ALIGN_E On x86_64, if key is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param [in,out] key Pointer to the ed25519_key object to initialize.
 
@@ -1241,6 +1243,8 @@ int wc_ed25519_verify_msg_final(const byte* sig, word32 sigLen,
 
     \return 0 on success
     \return negative on failure
+    \return BAD_ALIGN_E On x86_64, if key is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param key Ed25519 key structure
     \param heap Heap hint for memory allocation
@@ -1267,6 +1271,8 @@ int wc_ed25519_init_ex(ed25519_key* key, void* heap, int devId);
     \return BAD_FUNC_ARG if key is NULL, or id is NULL and len is greater
     than 0.
     \return BUFFER_E if len is negative or greater than ED25519_MAX_ID_LEN.
+    \return BAD_ALIGN_E On x86_64, if key is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param [in,out] key Pointer to the ed25519_key to initialize.
     \param [in] id Key identifier bytes.
@@ -1297,6 +1303,8 @@ int wc_ed25519_init_id(ed25519_key* key, const unsigned char* id, int len,
     \return 0 on success.
     \return BAD_FUNC_ARG if key or label is NULL.
     \return BUFFER_E if label is empty or longer than ED25519_MAX_LABEL_LEN.
+    \return BAD_ALIGN_E On x86_64, if key is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param [in,out] key Pointer to the ed25519_key to initialize.
     \param [in] label NUL-terminated label string.

doc/dox_comments/header_files/memory.h

@@ -109,7 +109,8 @@ void* wolfSSL_Realloc(void *ptr, size_t size, void* heap, int type);
     \brief This function registers the allocation functions used by wolfSSL.
     By default, if the system supports it, malloc/free and realloc are used.
     Using this function allows the user at runtime to install their own
-    memory handlers.
+    memory handlers. On x86_64 the allocator must return 16-byte aligned
+    memory like malloc().
 
     \return Success If successful this function will return 0.
     \return BAD_FUNC_ARG is the error that will be returned if a

doc/dox_comments/header_files/sha256.h

@@ -5,6 +5,8 @@
     called by wc_Sha256Hash.
 
     \return 0 Returned upon successfully initializing
+    \return BAD_ALIGN_E On x86_64, if sha256 is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param sha256 pointer to the sha256 structure to use for encryption
 
@@ -199,6 +201,8 @@ int wc_Sha256GetHash(wc_Sha256* sha256, byte* hash);
 
     \return 0 Success
     \return 1 Error returned because sha224 is null.
+    \return BAD_ALIGN_E On x86_64, if sha224 is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param sha224 Pointer to a Sha224 struct to initialize.
 
@@ -291,6 +295,8 @@ int wc_Sha224Final(wc_Sha224* sha224, byte* hash);
 
     \return 0 on success
     \return negative on error
+    \return BAD_ALIGN_E On x86_64, if sha256 is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param sha SHA256 structure
     \param heap Heap hint
@@ -407,6 +413,8 @@ int wc_Sha256_Grow(wc_Sha256* sha256, const byte* in, int inSz);
 
     \return 0 on success
     \return negative on error
+    \return BAD_ALIGN_E On x86_64, if dst is not 16-byte aligned.
+        dst is left unmodified.
 
     \param src Source SHA256 structure
     \param dst Destination SHA256 structure;
@@ -491,6 +499,8 @@ int wc_Sha256GetFlags(wc_Sha256* sha256, word32* flags);
 
     \return 0 on success
     \return negative on error
+    \return BAD_ALIGN_E On x86_64, if sha224 is not 16-byte aligned.
+        The structure is left unmodified.
 
     \param sha224 SHA224 structure
     \param heap Heap hint
@@ -621,6 +631,8 @@ int wc_Sha224GetHash(wc_Sha224* sha224, byte* hash);
 
     \return 0 on success
     \return negative on error
+    \return BAD_ALIGN_E On x86_64, if dst is not 16-byte aligned.
+        dst is left unmodified.
 
     \param src Source SHA224 structure
     \param dst Destination SHA224 structure

tests/api.c

@@ -14145,6 +14145,126 @@ static int test_wc_SetMutexCb(void)
     return EXPECT_RESULT();
 } /* End test_wc_SetMutexCb*/
 
+#if defined(WC_CTX_IS_ALIGNED) && !defined(HAVE_FIPS) && \
+    !defined(HAVE_SELFTEST) && (!defined(NO_SHA256) || !defined(NO_AES) || \
+    !defined(NO_HMAC) || defined(HAVE_CURVE25519) || defined(HAVE_ED25519))
+#define TEST_CTX_MISALIGNED_ENABLED
+
+/* Returns sz usable bytes starting 8 bytes past a 16-byte boundary. */
+static void* test_misaligned_alloc(byte** buf, size_t sz)
+{
+    *buf = (byte*)XMALLOC(sz + 32, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    if (*buf == NULL)
+        return NULL;
+    return *buf + 24 - ((wc_ptr_t)*buf & 15);
+}
+
+static int test_misaligned_filled(const void* ctx, size_t sz, byte val)
+{
+    const byte* p = (const byte*)ctx;
+    size_t i;
+
+    for (i = 0; i < sz; i++) {
+        if (p[i] != val)
+            return 0;
+    }
+    return 1;
+}
+
+#define TEST_MISALIGNED_RET(T) \
+    ((WC_ALIGNOF(T) >= 16) ? WC_NO_ERR_TRACE(BAD_ALIGN_E) : 0)
+
+#define TEST_CTX_MISALIGNED(T, initCall, freeCall)                      \
+    do {                                                                \
+        ExpectNotNull(ctx = test_misaligned_alloc(&buf, sizeof(T)));    \
+        if (ctx != NULL) {                                              \
+            XMEMSET(ctx, 0xA5, sizeof(T));                              \
+            ret = (initCall);                                           \
+            ExpectIntEQ(ret, TEST_MISALIGNED_RET(T));                   \
+            if (ret != 0)                                               \
+                ExpectTrue(test_misaligned_filled(ctx, sizeof(T), 0xA5)); \
+            freeCall;                                                   \
+            if (ret != 0)                                               \
+                ExpectTrue(test_misaligned_filled(ctx, sizeof(T), 0));  \
+        }                                                               \
+        XFREE(buf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);                 \
+        buf = NULL;                                                     \
+        ctx = NULL;                                                     \
+    } while (0)
+#endif
+
+/*
+ * Testing init functions on a context below its type's alignment
+ */
+static int test_wc_CtxInit_misaligned(void)
+{
+    EXPECT_DECLS;
+#ifdef TEST_CTX_MISALIGNED_ENABLED
+    byte* buf = NULL;
+    void* ctx = NULL;
+    int ret = 0;
+#ifndef NO_SHA256
+    wc_Sha256 sha256;
+#endif
+#ifdef WOLFSSL_SHA224
+    wc_Sha224 sha224;
+#endif
+#ifndef NO_HMAC
+    Hmac hmac;
+#endif
+
+#ifndef NO_SHA256
+    TEST_CTX_MISALIGNED(wc_Sha256, wc_InitSha256((wc_Sha256*)ctx),
+        wc_Sha256Free((wc_Sha256*)ctx));
+    XMEMSET(&sha256, 0, sizeof(sha256));
+    ExpectIntEQ(wc_InitSha256(&sha256), 0);
+    if (WC_ALIGNOF(wc_Sha256) >= 16) {
+        TEST_CTX_MISALIGNED(wc_Sha256,
+            wc_Sha256Copy(&sha256, (wc_Sha256*)ctx),
+            wc_Sha256Free((wc_Sha256*)ctx));
+    }
+    wc_Sha256Free(&sha256);
+#endif
+#ifdef WOLFSSL_SHA224
+    TEST_CTX_MISALIGNED(wc_Sha224, wc_InitSha224((wc_Sha224*)ctx),
+        wc_Sha224Free((wc_Sha224*)ctx));
+    XMEMSET(&sha224, 0, sizeof(sha224));
+    ExpectIntEQ(wc_InitSha224(&sha224), 0);
+    if (WC_ALIGNOF(wc_Sha224) >= 16) {
+        TEST_CTX_MISALIGNED(wc_Sha224,
+            wc_Sha224Copy(&sha224, (wc_Sha224*)ctx),
+            wc_Sha224Free((wc_Sha224*)ctx));
+    }
+    wc_Sha224Free(&sha224);
+#endif
+#ifndef NO_AES
+    TEST_CTX_MISALIGNED(Aes, wc_AesInit((Aes*)ctx, HEAP_HINT, INVALID_DEVID),
+        wc_AesFree((Aes*)ctx));
+#endif
+#ifndef NO_HMAC
+    TEST_CTX_MISALIGNED(Hmac, wc_HmacInit((Hmac*)ctx, HEAP_HINT,
+        INVALID_DEVID), wc_HmacFree((Hmac*)ctx));
+    XMEMSET(&hmac, 0, sizeof(hmac));
+    ExpectIntEQ(wc_HmacInit(&hmac, HEAP_HINT, INVALID_DEVID), 0);
+    if (WC_ALIGNOF(Hmac) >= 16) {
+        TEST_CTX_MISALIGNED(Hmac, wc_HmacCopy(&hmac, (Hmac*)ctx),
+            wc_HmacFree((Hmac*)ctx));
+    }
+    wc_HmacFree(&hmac);
+#endif
+#ifdef HAVE_CURVE25519
+    TEST_CTX_MISALIGNED(curve25519_key,
+        wc_curve25519_init((curve25519_key*)ctx),
+        wc_curve25519_free((curve25519_key*)ctx));
+#endif
+#ifdef HAVE_ED25519
+    TEST_CTX_MISALIGNED(ed25519_key, wc_ed25519_init((ed25519_key*)ctx),
+        wc_ed25519_free((ed25519_key*)ctx));
+#endif
+#endif
+    return EXPECT_RESULT();
+} /* End test_wc_CtxInit_misaligned */
+
 
 /*
  * Testing ToTraditional
@@ -46968,6 +47088,7 @@ TEST_CASE testCases[] = {
     TEST_DECL(test_ForceZero),
 
     TEST_DECL(test_wolfCrypt_Init),
+    TEST_DECL(test_wc_CtxInit_misaligned),
 
     TEST_DECL(test_wc_LoadStaticMemory_ex),
     TEST_DECL(test_wc_LoadStaticMemory_CTX),

wolfcrypt/src/aes.c

@@ -17045,6 +17045,10 @@ int wc_AesInit(Aes* aes, void* heap, int devId)
 
     if (aes == NULL)
         return BAD_FUNC_ARG;
+#ifdef WC_CTX_IS_ALIGNED
+    if (!WC_CTX_IS_ALIGNED(aes, Aes))
+        return BAD_ALIGN_E;
+#endif
 
     XMEMSET(aes, 0, sizeof(*aes));
 
@@ -17141,6 +17145,12 @@ void wc_AesFree(Aes* aes)
     if (aes == NULL) {
         return;
     }
+#ifdef WC_CTX_IS_ALIGNED
+    if (!WC_CTX_IS_ALIGNED(aes, Aes)) {
+        ForceZero(aes, sizeof(Aes));
+        return;
+    }
+#endif
 
 #if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
     #ifndef WOLF_CRYPTO_CB_FIND

wolfcrypt/src/curve25519.c

@@ -1384,6 +1384,11 @@ int wc_curve25519_init_ex(curve25519_key* key, void* heap, int devId)
     if (key == NULL) {
        ret = BAD_FUNC_ARG;
     }
+#ifdef WC_CTX_IS_ALIGNED
+    else if (!WC_CTX_IS_ALIGNED(key, curve25519_key)) {
+        ret = BAD_ALIGN_E;
+    }
+#endif
     else {
         XMEMSET(key, 0, sizeof(*key));
 
@@ -1426,6 +1431,12 @@ void wc_curve25519_free(curve25519_key* key)
 {
     if (key == NULL)
        return;
+#ifdef WC_CTX_IS_ALIGNED
+    if (!WC_CTX_IS_ALIGNED(key, curve25519_key)) {
+        ForceZero(key, sizeof(*key));
+        return;
+    }
+#endif
 
 #ifdef WOLFSSL_SE050
     se050_curve25519_free_key(key);

wolfcrypt/src/ed25519.c

@@ -1461,6 +1461,10 @@ int wc_ed25519_init_ex(ed25519_key* key, void* heap, int devId)
 {
     if (key == NULL)
         return BAD_FUNC_ARG;
+#ifdef WC_CTX_IS_ALIGNED
+    if (!WC_CTX_IS_ALIGNED(key, ed25519_key))
+        return BAD_ALIGN_E;
+#endif
 
     /* for init, ensure the key is zeroed*/
     XMEMSET(key, 0, sizeof(ed25519_key));
@@ -1544,6 +1548,12 @@ void wc_ed25519_free(ed25519_key* key)
 {
     if (key == NULL)
         return;
+#ifdef WC_CTX_IS_ALIGNED
+    if (!WC_CTX_IS_ALIGNED(key, ed25519_key)) {
+        ForceZero(key, sizeof(*key));
+        return;
+    }
+#endif
 
 #ifdef WOLFSSL_ED25519_PERSISTENT_SHA
     ed25519_hash_free(key, &key->sha);