esp-cryptoauthlib unable to build after idf 5.0.1 upgrade (CON-440)

[JonathanWitthoeft]

Perhaps there is some conflict with cryptoauth lib and the matter sdk, as I can build fine in idf 5.0.1. This is in follow up to this issue, as there are many similarities: https://github.com/espressif/esp-idf/issues/11061

I have attached the full modified sdkconfig file for the examples/light project, however simple steps to reproduce are explained below.

Steps to reproduce. I was able to reproduce this error with the examples/light project by doing the following.

1) Modify the main/idf_component.yml to include the espressif/esp-cryptoauthlib dependency:

dependencies:
  espressif/cmake_utilities:
    version: 0.*
    rules: # will add "optional_component" only when all if clauses are True
      - if: "idf_version >=5.0"
      - if: "target in [esp32c2]"
  espressif/esp-cryptoauthlib: "^3.3.1"

2) Unset both BT_NIMBLE_CRYPTO_STACK_MBEDTLS and MBEDTLS_ECP_RESTARTABLE in menuconfig (If not: MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative or PSA-based ECP implementation)

3) In menuconfig set the following esp-cryptoauth configuration:

+#
+# esp-cryptoauthlib
+#
+# CONFIG_ATECC608A_TNG is not set
+# CONFIG_ATECC608A_TFLEX is not set
+CONFIG_ATECC608A_TCUSTOM=y
+CONFIG_ATCA_MBEDTLS_ECDSA=y
+CONFIG_ATCA_MBEDTLS_ECDSA_SIGN=y
+CONFIG_ATCA_MBEDTLS_ECDSA_VERIFY=y
+CONFIG_ATCA_I2C_SDA_PIN=16
+CONFIG_ATCA_I2C_SCL_PIN=17
+CONFIG_ATCA_I2C_ADDRESS=0x6A
+CONFIG_ATCA_I2C_BAUD_RATE=100000
+# end of esp-cryptoauthlib

This will lead you to the following error:

In function 'atcac_sw_sha1_finish':
cc1: error: 'atcac_sw_sha2_256_finish' accessing 32 bytes in a region of size 20 [-Werror=stringop-overflow=]
cc1: note: referencing argument 2 of type 'uint8_t *' {aka 'unsigned char *'}
esp-cryptoauthlib/cryptoauthlib/lib/mbedtls/atca_mbedtls_wrap.c:419:5: note: in a call to function 'atcac_sw_sha2_256_finish'
  419 | int atcac_sw_sha2_256_finish(
      |     ^~~~~~~~~~~~~~~~~~~~~~~~

[JonathanWitthoeft]

@dhairyashah1 Can someone look into this?

[dhairyashah1]

Thanks @JonathanWitthoeft, we will look into this and get back.

[JonathanWitthoeft]

@dhairyashah1 Despite having CONFIG_COMPILER_OPTIMIZATION_DEFAULT=y, I think it has something to do with the compiler optimization. I got it to build with a work around, but it is not pretty.

int atcac_sw_sha1_finish(
    atcac_sha1_ctx* ctx,                          /**< [in] pointer to a hash context */
    uint8_t         digest[ATCA_SHA1_DIGEST_SIZE] /**< [out] output buffer (20 bytes) */
    )
{
    return _atca_mbedtls_md_finish(ctx, digest, NULL);
}

int atcac_sw_sha2_256_finish(
    atcac_sha2_256_ctx* ctx,                              /**< [in] pointer to a hash context */
    uint8_t             digest[ATCA_SHA2_256_DIGEST_SIZE] /**< [out] output buffer (32 bytes) */
    )
{
    return _atca_mbedtls_md_finish(ctx, digest, NULL);
}

The above functions look almost exactly the same so to trick the compiler I copied the contents of _atca_mbedtls_md_finish and pasted it in atcac_sw_sha1_finish :

int atcac_sw_sha1_finish(
    atcac_sha1_ctx* ctx,                          /**< [in] pointer to a hash context */
    uint8_t         digest[ATCA_SHA1_DIGEST_SIZE] /**< [out] output buffer (20 bytes) */
    )
{
    ATCA_STATUS status = ATCA_BAD_PARAM;

    if (ctx)
    {
        int ret = mbedtls_md_finish(ctx, digest);

        mbedtls_md_free(ctx);

        status = (!ret) ? ATCA_SUCCESS : ATCA_FUNC_FAIL;
    }
    return status;

    //return _atca_mbedtls_md_finish(ctx, digest, NULL);
}

[ivishaltejwani]

esp-matter doesnt work properly with espidf 5.0.1 , 4.4.4 it compiles properly

[dhairyashah1]

@JonathanWitthoeft

idf_build_set_property(COMPILE_OPTIONS "-Wno-format-nonliteral;-Wno-format-security;-Wno-stringop-overflow" APPEND)

I added the above -Wno-stringop-overflow flag in examples/light/CMakeLists.txt and the light example seems to compile successfully with idf-version 5.0.1.

[dhairyashah1]

@ivishaltejwani could share details on what exact esp-matter error are you facing with esp-idf v5.0.1. Did you follow all the setup & installation guidelines mentioned in the docs?

[JonathanWitthoeft]

@dhairyashah1 Does -Wno-stringop-overflow actually fix the compilers optimization error, or just suppress the warning? Is sha_1_finish going to still be linked to sha_256_finish, if we ignore the error during compilation?

[JonathanWitthoeft]

esp-matter doesnt work properly with espidf 5.0.1 , 4.4.4 it compiles properly

Do you mean esp-cryptoauthlib? I updated esp-matter to use espidf 5.0.1, as that is instructed in the docs, and everything else seems to be working ok so far.