Repository: randombit/botan
Pull request #3626 (2023-07-13 09:54:48)

Add missing size limits checks for argon2 on 64-bit arch
The limits are described in RFC 9106.
We also do some casting to uint32_t that would break.

reneme: Good catch! @randombit Perhaps get this into 3.1.1?

Patch:
diff --git a/news.rst b/news.rst
index 5a93cf52c..e6b4b0868 100644
--- a/news.rst
+++ b/news.rst
@@ -1,13 +1,9 @@
 Release Notes
 ========================================
 
-Version 3.1.1, 2023-07-13
+Version 3.2.0, Not Yet Released
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-* Fix two tests which were insufficiently serialized. This would
-  cause sporadic test failures, particularly on machines with
-  many cores. (GH #3625 #3623)
-
 Version 3.1.0, 2023-07-11
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/readme.rst b/readme.rst
index cf5dd71e6..e746acc37 100644
--- a/readme.rst
+++ b/readme.rst
@@ -56,9 +56,9 @@ The latest release from the Botan2 release series is
 released on 2022-11-16.
 
 The latest release from the Botan3 release series is
-`3.1.1 <https://botan.randombit.net/releases/Botan-3.1.1.tar.xz>`_
-`(sig) <https://botan.randombit.net/releases/Botan-3.1.1.tar.xz.asc>`_,
-released on 2023-07-13.
+`3.1.0 <https://botan.randombit.net/releases/Botan-3.1.0.tar.xz>`_
+`(sig) <https://botan.randombit.net/releases/Botan-3.1.0.tar.xz.asc>`_,
+released on 2023-07-11.
 
 All releases are signed with a `PGP key <https://botan.randombit.net/pgpkey.txt>`_.
 See the `release notes <https://botan.randombit.net/news.html>`_ for
diff --git a/src/build-data/version.txt b/src/build-data/version.txt
index 4898938d6..64d216ea7 100644
--- a/src/build-data/version.txt
+++ b/src/build-data/version.txt
@@ -1,7 +1,7 @@
 
 release_major = 3
-release_minor = 1
-release_patch = 1
+release_minor = 2
+release_patch = 0
 release_suffix = ''
 release_so_abi_rev = 0
 
diff --git a/src/lib/pbkdf/argon2/argon2.cpp b/src/lib/pbkdf/argon2/argon2.cpp
index 988a51174..4e7e749d9 100644
--- a/src/lib/pbkdf/argon2/argon2.cpp
+++ b/src/lib/pbkdf/argon2/argon2.cpp
@@ -12,6 +12,7 @@
 #include <botan/internal/fmt.h>
 #include <botan/internal/loadstor.h>
 #include <botan/internal/rotate.h>
+#include <limits>
 
 #if defined(BOTAN_HAS_THREAD_UTILS)
    #include <botan/internal/thread_pool.h>
@@ -371,7 +372,12 @@ void Argon2::argon2(uint8_t output[],
                     size_t key_len,
                     const uint8_t ad[],
                     size_t ad_len) const {
-   BOTAN_ARG_CHECK(output_len >= 4, "Invalid Argon2 output length");
+   BOTAN_ARG_CHECK(output_len >= 4 && output_len <= std::numeric_limits<uint32_t>::max(),
+                   "Invalid Argon2 output length");
+   BOTAN_ARG_CHECK(password_len <= std::numeric_limits<uint32_t>::max(), "Invalid Argon2 password length");
+   BOTAN_ARG_CHECK(salt_len <= std::numeric_limits<uint32_t>::max(), "Invalid Argon2 salt length");
+   BOTAN_ARG_CHECK(key_len <= std::numeric_limits<uint32_t>::max(), "Invalid Argon2 key length");
+   BOTAN_ARG_CHECK(ad_len <= std::numeric_limits<uint32_t>::max(), "Invalid Argon2 ad length");
 
    auto blake2 = HashFunction::create_or_throw("BLAKE2b");
 
diff --git a/src/lib/pbkdf/argon2/argon2pwhash.cpp b/src/lib/pbkdf/argon2/argon2pwhash.cpp
index 45ab3bce1..cc103cd18 100644
--- a/src/lib/pbkdf/argon2/argon2pwhash.cpp
+++ b/src/lib/pbkdf/argon2/argon2pwhash.cpp
@@ -10,13 +10,14 @@
 #include <botan/internal/fmt.h>
 #include <botan/internal/timer.h>
 #include <algorithm>
+#include <limits>
 
 namespace Botan {
 
 Argon2::Argon2(uint8_t family, size_t M, size_t t, size_t p) : m_family(family), m_M(M), m_t(t), m_p(p) {
    BOTAN_ARG_CHECK(m_p >= 1 && m_p <= 128, "Invalid Argon2 threads parameter");
    BOTAN_ARG_CHECK(m_M >= 8 * m_p && m_M <= 8192 * 1024, "Invalid Argon2 M parameter");
-   BOTAN_ARG_CHECK(m_t >= 1, "Invalid Argon2 t parameter");
+   BOTAN_ARG_CHECK(m_t >= 1 && m_t <= std::numeric_limits<uint32_t>::max(), "Invalid Argon2 t parameter");
 }
 
 void Argon2::derive_key(uint8_t output[],


Test patch:
diff --git a/src/tests/test_ec_group.cpp b/src/tests/test_ec_group.cpp
index 59223dacd..ae902f13c 100644
--- a/src/tests/test_ec_group.cpp
+++ b/src/tests/test_ec_group.cpp
@@ -743,7 +743,7 @@ class ECC_Unit_Tests final : public Test {
       }
 };
 
-BOTAN_REGISTER_SERIALIZED_TEST("pubkey", "ecc_unit", ECC_Unit_Tests);
+BOTAN_REGISTER_TEST("pubkey", "ecc_unit", ECC_Unit_Tests);
 
    #if defined(BOTAN_HAS_ECDSA)
 
diff --git a/src/tests/test_zfec.cpp b/src/tests/test_zfec.cpp
index 199cf66c9..8e873742d 100644
--- a/src/tests/test_zfec.cpp
+++ b/src/tests/test_zfec.cpp
@@ -102,7 +102,7 @@ class ZFEC_KAT final : public Text_Based_Test {
       }
 };
 
-BOTAN_REGISTER_SERIALIZED_TEST("zfec", "zfec", ZFEC_KAT);
+BOTAN_REGISTER_TEST("zfec", "zfec", ZFEC_KAT);
 
 }  // namespace Botan_Tests
 
diff --git a/src/tests/tests.cpp b/src/tests/tests.cpp
index 3c622e1f7..591a0c181 100644
--- a/src/tests/tests.cpp
+++ b/src/tests/tests.cpp
@@ -1048,10 +1048,6 @@ std::vector<Test::Result> Text_Based_Test::run() {
             throw Test_Error("Unknown test pragma '" + line + "' in " + m_cur_src_name);
          }
 
-         if(!Test_Registry::instance().needs_serialization(this->test_name())) {
-            throw Test_Error(Botan::fmt("'{}' used cpuid control but is not serialized", this->test_name()));
-         }
-
          m_cpu_flags = parse_cpuid_bits(pragma_tokens);
 
          continue;
diff --git a/src/tests/tests.h b/src/tests/tests.h
index fe70c5e50..998018b74 100644
--- a/src/tests/tests.h
+++ b/src/tests/tests.h
@@ -555,10 +555,6 @@ class Test {
 
       virtual std::vector<std::string> possible_providers(const std::string&);
 
-      void set_test_name(const std::string& name) { m_test_name = name; }
-
-      const std::string& test_name() const { return m_test_name; }
-
       void set_registration_location(CodeLocation location) { m_registration_location = std::move(location); }
 
       const std::optional<CodeLocation>& registration_location() const { return m_registration_location; }
@@ -644,7 +640,6 @@ class Test {
       static Test_Options m_opts;
       static std::shared_ptr<Botan::RandomNumberGenerator> m_test_rng;
 
-      std::string m_test_name;                              // The string ID that was used to register this test
       std::optional<CodeLocation> m_registration_location;  /// The source file location where the test was registered
 };
 
@@ -659,9 +654,8 @@ class TestClassRegistration {
                             bool smoke_test,
                             bool needs_serialization,
                             CodeLocation registration_location) {
-         Test::register_test(std::move(category), name, smoke_test, needs_serialization, [=] {
+         Test::register_test(std::move(category), std::move(name), smoke_test, needs_serialization, [=] {
             auto test = std::make_unique<Test_Class>();
-            test->set_test_name(name);
             test->set_registration_location(registration_location);
             return test;
          });
@@ -737,9 +731,8 @@ class TestFnRegistration {
                          bool needs_serialization,
                          CodeLocation registration_location,
                          TestFns... fn) {
-         Test::register_test(std::move(category), name, smoke_test, needs_serialization, [=] {
+         Test::register_test(std::move(category), std::move(name), smoke_test, needs_serialization, [=] {
             auto test = std::make_unique<FnTest>(fn...);
-            test->set_test_name(name);
             test->set_registration_location(std::move(registration_location));
             return test;
          });