Skip to content

Fix Coverity DEADCODE findings in COSE MAC and CBOR decode paths #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattia-moffa merged 1 commit into from
Jun 23, 2026
Merged

Fix Coverity DEADCODE findings in COSE MAC and CBOR decode paths #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,10 @@ make coverage # Run tests with gcov
make coverage-force-failure # Include crypto failure path testing
```

<a href="https://scan.coverity.com/projects/wolfcose">
<img alt="Coverity Scan Build Status"
src="https://scan.coverity.com/projects/32918/badge.svg"/>
</a>
<a href="https://github.com/wolfSSL/wolfCOSE/actions">
<img alt="CI Status"
src="https://img.shields.io/github/actions/workflow/status/wolfSSL/wolfCOSE/build-test.yml?label=CI&logo=github"/>
Expand Down
12 changes: 0 additions & 12 deletions src/wolfcose.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6105,10 +6105,6 @@ int wc_CoseMac0_Create(const WOLFCOSE_KEY* key, int32_t alg,
(payload == NULL) && (detachedPayload == NULL)) {
ret = WOLFCOSE_E_INVALID_ARG;
}
if ((ret == WOLFCOSE_SUCCESS) &&
(macPayload == NULL) && (macPayloadLen > 0u)) {
ret = WOLFCOSE_E_INVALID_ARG;
}
/* Reject inconsistent (kid, kidLen) so the kid is never silently dropped. */
if ((ret == WOLFCOSE_SUCCESS) &&
(((kid != NULL) && (kidLen == 0u)) ||
Expand Down Expand Up @@ -7859,10 +7855,6 @@ int wc_CoseMac_Create(const WOLFCOSE_RECIPIENT* recipients,
ret = WOLFCOSE_E_CRYPTO;
}
}
if (hmacInited != 0) {
(void)wc_HmacFree(&hmac);
hmacInited = 0;
}
}
else
#endif /* WOLFCOSE_HAVE_HMAC */
Expand Down Expand Up @@ -8275,10 +8267,6 @@ int wc_CoseMac_Verify(const WOLFCOSE_RECIPIENT* recipient,
ret = WOLFCOSE_E_CRYPTO;
}
}
if (hmacInited != 0) {
(void)wc_HmacFree(&hmac);
hmacInited = 0;
}
}
else
#endif /* WOLFCOSE_HAVE_HMAC */
Expand Down
7 changes: 2 additions & 5 deletions src/wolfcose_cbor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,14 +233,11 @@ int wolfCose_CBOR_DecodeHead(WOLFCOSE_CBOR_CTX* ctx, WOLFCOSE_CBOR_ITEM* item)
}
}

/* Advance past bstr/tstr bytes using overflow-safe bounds. */
/* Compare the 64-bit length against remaining bytes (no size_t cast). */
if (ret == WOLFCOSE_SUCCESS) {
if ((item->majorType == WOLFCOSE_CBOR_BSTR) ||
(item->majorType == WOLFCOSE_CBOR_TSTR)) {
if (item->val > (uint64_t)SIZE_MAX) {
ret = WOLFCOSE_E_CBOR_OVERFLOW;
}
else if ((size_t)item->val > (ctx->bufSz - ctx->idx)) {
if (item->val > (uint64_t)(ctx->bufSz - ctx->idx)) {
ret = WOLFCOSE_E_CBOR_MALFORMED;
}
else {
Expand Down
Loading