Open gilles-peskine-arm opened 3 years ago
https://github.com/ARMmbed/mbedtls/pull/4506 has done the critical part, which is the sha512 functions. I'm leaving this task open for all the other array parameters, but this is low-importance since all the remaining ones actually do have a fixed size so they aren't causing trouble, and we may well want to stop here.
Context and rationale
A few functions in the API have a parameter of array type. Array types are equivalent to pointers in function parameters as far as the C language is concerned: the array size is purely indicative. However, static analyzers including compilers don't always see it that way and may treat the array size as meaningful.
See https://github.com/ARMmbed/mbedtls/issues/4130 for why this is a problem. Popular compilers are increasingly likely to complain that
mbedtls_sha512_finish
should not output to a 48-byte buffer, even when it's calculating a SHA-384 hash, because its output is declared asunsigned char[64]
.Proposal
Change array types in API function parameters to pointers.
Work items for 3.0
sha512_finish
, which is the only case I'm aware of that is a problem in practice.Work items for 3.x
Work items for 4.0
Since low-level crypto APIs are becoming private, only one public headers still has array parameters:
ssl.h
. Let's remove those.