From 5c8bd68f6f897ca3c094c54a1770685633687152 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 14:48:51 +0200 Subject: [PATCH] libseckey: Fix and document size query call with NULL key_token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Functions SK_CCA_generate_ec_key_pair(), SK_CCA_generate_ec_key_pair(), SK_EP11_generate_ec_key_pair() and SK_EP11_generate_rsa_key_pair() are supposed to allow parameter key_token to be NULL. In this case the required buffer size is returned in key_token_length only. This size query does not work because the parameter checking rejects the call with a NULL key_token returning -EINVAL. Currently the size query is not used by any known caller, but lets correct it anyway. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libseckey/sk_cca.c | 12 ++++++++---- libseckey/sk_ep11.c | 14 +++++++++----- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/libseckey/sk_cca.c b/libseckey/sk_cca.c index 24ae8bc5..14a260e1 100644 --- a/libseckey/sk_cca.c +++ b/libseckey/sk_cca.c @@ -258,7 +258,9 @@ static int sk_cca_get_library_functions(const struct sk_ext_cca_lib *cca_lib, * * @param cca_lib the CCA library structure * @param curve_nid the nid specifying the curve. - * @param key_token a buffer to store the generated key token + * @param key_token a buffer to store the generated key token. If NULL, + * the required buffer size is returned in + * key_token_length (size query). * @param key_token_length On entry: the size of the buffer * On return: the size of the key token * @param debug if true, debug messages are printed @@ -286,7 +288,7 @@ int SK_CCA_generate_ec_key_pair(const struct sk_ext_cca_lib *cca_lib, long param1 = 0; int rc; - if (cca_lib == NULL || key_token == NULL || key_token_length == NULL) + if (cca_lib == NULL || key_token_length == NULL) return -EINVAL; if (key_token == NULL) { @@ -384,7 +386,9 @@ int SK_CCA_generate_ec_key_pair(const struct sk_ext_cca_lib *cca_lib, * 3, 5, 17, 257, or 65537. Specify zero to choose the * exponent by random (only possible for modulus_bits * up to 2048). - * @param key_token a buffer to store the generated key token + * @param key_token a buffer to store the generated key token. If NULL, + * the required buffer size is returned in + * key_token_length (size query). * @param key_token_length On entry: the size of the buffer * On return: the size of the key token * @param debug if true, debug messages are printed @@ -412,7 +416,7 @@ int SK_CCA_generate_rsa_key_pair(const struct sk_ext_cca_lib *cca_lib, long param1 = 0; int rc; - if (cca_lib == NULL || key_token == NULL || key_token_length == NULL) + if (cca_lib == NULL || key_token_length == NULL) return -EINVAL; if (key_token == NULL) { diff --git a/libseckey/sk_ep11.c b/libseckey/sk_ep11.c index 8b166873..6f461962 100644 --- a/libseckey/sk_ep11.c +++ b/libseckey/sk_ep11.c @@ -195,7 +195,7 @@ static int sk_ep11_generate_key_pair(const struct sk_ext_ep11_lib *ep11_lib, CK_RV rv; int rc; - if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL) + if (ep11_lib == NULL || key_token_length == NULL) return -EINVAL; if (key_token == NULL) { @@ -262,7 +262,9 @@ static int sk_ep11_generate_key_pair(const struct sk_ext_ep11_lib *ep11_lib, * * @param ep11_lib the Ep11 library structure * @param curve_nid the nid specifying the curve. - * @param key_token a buffer to store the generated key token + * @param key_token a buffer to store the generated key token. If NULL, + * the required buffer size is returned in + * key_token_length (size query). * @param key_token_length On entry: the size of the buffer * On return: the size of the key token * @param debug if true, debug messages are printed @@ -292,7 +294,7 @@ int SK_EP11_generate_ec_key_pair(const struct sk_ext_ep11_lib *ep11_lib, const struct sk_ec_curve_info *curve; int rc; - if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL) + if (ep11_lib == NULL || key_token_length == NULL) return -EINVAL; sk_debug(debug, "curve_nid: %d", curve_nid); @@ -331,7 +333,9 @@ int SK_EP11_generate_ec_key_pair(const struct sk_ext_ep11_lib *ep11_lib, * 3, 5, 17, 257, or 65537. Specify zero to choose the * exponent by random. * @param x9_31 if true, generate a X9.31 RSA key - * @param key_token a buffer to store the generated key token + * @param key_token a buffer to store the generated key token. If NULL, + * the required buffer size is returned in + * key_token_length (size query). * @param key_token_length On entry: the size of the buffer * On return: the size of the key token * @param debug if true, debug messages are printed @@ -365,7 +369,7 @@ int SK_EP11_generate_rsa_key_pair(const struct sk_ext_ep11_lib *ep11_lib, CK_ULONG priv_tmpl_num = sizeof(priv_tmpl) / sizeof(CK_ATTRIBUTE); int rc; - if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL) + if (ep11_lib == NULL || key_token_length == NULL) return -EINVAL; sk_debug(debug, "modulus_bits: %lu pub_exp: %u x9_31: %d",