From 331fd7f79fc7292bb6f8653521feacd00b7967cb Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Thu, 5 Sep 2024 12:17:17 +0530 Subject: [PATCH] fix(mbedtls/port): Check signature hash length before using ECDSA hardware --- components/mbedtls/port/ecdsa/ecdsa_alt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/mbedtls/port/ecdsa/ecdsa_alt.c b/components/mbedtls/port/ecdsa/ecdsa_alt.c index 1f46381987..752b046d0c 100644 --- a/components/mbedtls/port/ecdsa/ecdsa_alt.c +++ b/components/mbedtls/port/ecdsa/ecdsa_alt.c @@ -674,7 +674,7 @@ int __wrap_mbedtls_ecdsa_verify(mbedtls_ecp_group *grp, const mbedtls_mpi *r, const mbedtls_mpi *s) { - if (grp->id == MBEDTLS_ECP_DP_SECP192R1 || grp->id == MBEDTLS_ECP_DP_SECP256R1) { + if ((grp->id == MBEDTLS_ECP_DP_SECP192R1 || grp->id == MBEDTLS_ECP_DP_SECP256R1) && blen == ECDSA_SHA_LEN) { return esp_ecdsa_verify(grp, buf, blen, Q, r, s); } else { return __real_mbedtls_ecdsa_verify(grp, buf, blen, Q, r, s);