yuichitk / libcsuit Goto Github PK

Need diet when libcsuit would be enough stable to do it.

Issue:

The suit_payload_t array inside the suit_payloads_t struct can be overflowed by the function suit_decode_envelope_from_item.
A missing check of suit_payloads_t.len allows writing beyond the suit_payloads_t.payload array boundary.
This occurs at the condition suit_manifest_decode.c:1032, where values are written to the payload at position payloads.len and payloads.len is increased.

Reproduction:

The examples/suit_manifest_parser_main_psa.c file can be used for reproduction.
Therefore replace the given manifest with this manifest: crash.zip
Execution should lead to a Segmentation fault.

Affects:

master (commit 6fdbecd).
At a quick glance it seems that there are more length checks missing for arrays in typedefs of suit_common.h.

Suggested patch:

#16: Check if payloads.len >= SUIT_MAX_ARRAY_LENGTH before accessing payload array items.

use Doxygen of something

As an extension to the t_cose library I have added support for encryption to COSE with the HPKE-based key exchange. You can find the code here: laurencelundblade/t_cose#46

The draft that describes the functionality is here:
https://datatracker.ietf.org/doc/html/draft-ietf-suit-firmware-encryption-03

Are you planning to add encryption capabilities to the libcsuit library?

• generate integrated-payload manifest using TEEP example 1 and 3
• parse it

current version supports only SHA256

Currently, the suit_create_es256_public_key() function assumes ECC keys based on NIST P256r1. We should make this function more generic to also use other key sizes.

The function can be found in https://github.com/yuichitk/libcsuit/blob/master/src/suit_cose.c

use these functions below, instead of creating context from QCBOR_BYTE_STRING item with QCBOREncode_Init() and QCBORDecode_Init() .

QCBOREncode_BstrWrap()
QCBOREncode_CloseBstrWrap()
QCBORDecode_EnterBstrWrapped()
QCBORDecode_ExitBstrWrapped()