| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix: address security review findings on rsa, bn, sha2, mldsa, cmac and CI - ci: run the riscv64 self-hosted job on push only, so untrusted PR code cannot execute on the self-hosted runner - sha2: gate the multi-buffer SHA256 path on the ARM SHA2 extension at init to avoid SIGILL on cores without it; add missing input checks to the one-shot CRYPT_SHA256_MB - mldsa: decrement the loop counter in the ARMv8 UseHint32/88 routines; the missing decrement emitted a 17th 64-byte chunk store, writing 64 bytes past each w[i] polynomial during signature verification. Add an SDV case with a canary after the last polynomial to guard the bound - rsa: reject inLen < 2 in CRYPT_RSA_VerifyPkcsV15Type2TLS before reading in[0]/in[1] to prevent an out-of-bounds read with a malformed short modulus - bn: BN_GenPrime now retries only on a composite candidate and aborts on real errors, preventing an infinite loop when the rand source fails persistently (aligned with OpenSSL behavior) - cmac: replace NULL + 0 pointer arithmetic on empty updates with an index loop to remove undefined behavior - curve25519: clear the partially duplicated key context on the DupCtx failure path - benchmark: reject -l values beyond the fixed buffer size Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1803 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1816 | 10 天前 | |
feat: Add cross-platform support for Darwin/macOS **Core Platform Support:** - Add Darwin/macOS platform detection and conditional compilation - Implement platform-specific library extensions (.dylib for macOS, .so for Linux) - Enhanced dynamic library loading with cross-platform error handling - Platform-optimized time functions (clock_gettime_nsec_np for macOS) - Add App module support for Darwin/macOS **Threading & Synchronization:** - BSL: Migrate from simple integer flags to proper pthread_once_t implementation - Add BSL_SAL_OnceControl type with platform-specific implementations - Implement thread-safe one-time initialization across platforms - Fix memory initialization patterns for thread-once controls **Build System Improvements:** - Remove GNU ld-specific flags for test-framework use c function pointer replace or stub_utils.h to hook target function - Boundcheck components will linked as static library for tests, reduce tests dynamic library deps - Update CMake configurations for Darwin support **Test Framework Enhancements:** - Replace jmp_buf with sigjmp_buf for better signal handling - Update time handling to avoid platform-specific gmtime issues - Improve entropy test stability across platforms - Add proper RAND initialization/deinitialization **Entropy & Cryptographic Updates:** - Temporarily disable CPU jitter entropy on macOS (pending validation) - Add cross-platform entropy source management - Update DRBG configuration for improved compatibility - Enhance hardware entropy detection and handling **Network & I/O:** - Extend POSIX network functions to support both Linux and Darwin - Add file accessibility checks before dynamic loading - Improve error handling for symbol resolution across platforms - Update socket and I/O operations for cross-platform compatibility Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/677 | 9 个月前 | |
fix:Fix the issue where the chain is not cleared when only one certificate is loaded in HITLS_CFG_UseCertificateChainBuffer Signed-off-by: balabala-123 <guozhang4@huawei.com> Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1541 | 3 个月前 | |
Fixed missing validation and memory issues Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1612 | 2 个月前 | |
Fix some code issues and comments 1、Fix macro wrapping of ParseHandShakeMSG function 2、Fix HITLS_CRYPT_Decrypt exception branch handling Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1610 | 2 个月前 | |
fix: correct provider key buffer parse arguments Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1840 | 4 天前 | |
feat:minimization for protocol | 7 个月前 | |
crypto: add Paillier HE provider load Add a simple Paillier provider for homomorphic add, multiply, message encode and decode callbacks, and cover provider pkey context creation and successful provider unload in the SDV Paillier test suite. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1672 | 1 个月前 | |
crypto: remove unused FIPS provider and harden MdMB/RSA checks - remove fips_prov sources and HITLS_CRYPTO_CMVP_FIPS build/test wiring - keep CMVP selftest guards scoped to ISO19790 and SM providers - validate CRYPT_EAL_MdMB update/final state transitions - check RSA param value/valueLen before reading MD and MGF IDs Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1341 | 3 个月前 |