From 682d8f3e894ea4b2ee88eec064984f230832dfa6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 1 Jun 2026 12:49:33 +0200 Subject: [PATCH] psa-rsa: also protect OUTPUT_TOO_LARGE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- library/psa_crypto_rsa.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/library/psa_crypto_rsa.c b/library/psa_crypto_rsa.c index 170774ee1a..322ede0701 100644 --- a/library/psa_crypto_rsa.c +++ b/library/psa_crypto_rsa.c @@ -658,15 +658,23 @@ psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attribut output_length, input, output, output_size); /* We want to convert ret into a psa status without allowing an - * attacker to distinguish between 0 and invalid padding. Since - * mbedtls_psa_error() is leaky, hide the difference from it. */ + * attacker to distinguish between 0, invalid padding, or buffer too + * small. (It's OK if the attacker distinguishes between one of the + * above three and other status such as out of memory.) Since + * mbedtls_to_psa_error() is leaky, hide the difference from it. */ mbedtls_ct_condition_t bad_padding = mbedtls_ct_uint_eq( (mbedtls_ct_uint_t) ret, (mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_INVALID_PADDING); + mbedtls_ct_condition_t large_msg = mbedtls_ct_uint_eq( + (mbedtls_ct_uint_t) ret, + (mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE); ret = mbedtls_ct_error_if(bad_padding, 0, ret); + ret = mbedtls_ct_error_if(large_msg, 0, ret); status = mbedtls_to_psa_error(ret); status = mbedtls_ct_error_if(bad_padding, PSA_ERROR_INVALID_PADDING, status); + status = mbedtls_ct_error_if(large_msg, + PSA_ERROR_BUFFER_TOO_SMALL, status); #else status = PSA_ERROR_NOT_SUPPORTED; #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */