| fix: address security review findings on rsa, bn, sha2, mldsa, cmac and CI - ci: run the riscv64 self-hosted job on push only, so untrusted PR code cannot execute on the self-hosted runner - sha2: gate the multi-buffer SHA256 path on the ARM SHA2 extension at init to avoid SIGILL on cores without it; add missing input checks to the one-shot CRYPT_SHA256_MB - mldsa: decrement the loop counter in the ARMv8 UseHint32/88 routines; the missing decrement emitted a 17th 64-byte chunk store, writing 64 bytes past each w[i] polynomial during signature verification. Add an SDV case with a canary after the last polynomial to guard the bound - rsa: reject inLen < 2 in CRYPT_RSA_VerifyPkcsV15Type2TLS before reading in[0]/in[1] to prevent an out-of-bounds read with a malformed short modulus - bn: BN_GenPrime now retries only on a composite candidate and aborts on real errors, preventing an infinite loop when the rand source fails persistently (aligned with OpenSSL behavior) - cmac: replace NULL + 0 pointer arithmetic on empty updates with an index loop to remove undefined behavior - curve25519: clear the partially duplicated key context on the DupCtx failure path - benchmark: reject -l values beyond the fixed buffer size Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1803 | 22 天前 |