From f1dc979f27af0a0e8ad261ea008c4a52229c5b60 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 29 May 2026 13:29:51 +0200 Subject: [PATCH] psa: avoid leaking padding errors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Padding errors should be indistiguishable from success. Signed-off-by: Manuel Pégourié-Gonnard --- library/psa_crypto.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index 0dfd71d540..c2785ea3cd 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -3568,7 +3568,12 @@ exit: LOCAL_INPUT_FREE(salt_external, salt); LOCAL_OUTPUT_FREE(output_external, output); - return (status == PSA_SUCCESS) ? unlock_status : status; + /* Don't branch on status as it is a sensitive value + * (it reveals whether padding was valid). + * Instead branch on unlock_status. That means when both status and + * unlock_status were errors, we'll return the unlock error while we would + * normally return the first error, but that's better than leaking info. */ + return (unlock_status != PSA_SUCCESS) ? unlock_status : status; } /****************************************************************/