Fix STM32 CubeMX AES-GCM AAD over-read from HAL word reads (ST SA0076) - #11102
Conversation
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Mitigates an STM32Cube HAL CRYP AES-GCM issue (ST SA0076) where AAD can be over-read due to HAL performing trailing 32-bit word reads, by ensuring the AAD buffer provided to HAL is word-padded without altering the GHASH length reported to the peripheral.
Changes:
- Introduces
STM_CRYPT_HEADER_PAD_WIDTHto express the HAL’s word read/pad granularity (default 4 bytes). - Updates STM32 AES-GCM encrypt/decrypt paths to allocate/copy a zero-padded AAD buffer sized to a word boundary while keeping the HAL-reported AAD length unchanged.
- Adds cleanup to avoid leaking the allocated AAD buffer when the HW mutex lock fails.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| wolfssl/wolfcrypt/port/st/stm32.h | Adds a configurable pad-width macro for STM32 HAL AAD word-padding behavior. |
| wolfcrypt/src/aes.c | Pads AAD buffers up to word size for STM32 AES-GCM, and frees temp buffers on mutex-lock failure. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Jenkins retest this please |
Description
Fix STM32 CubeMX AES-GCM AAD over-read from HAL word reads (ST SA0076)
This fix mitigates an issue in the STM32Cube HAL CRYP driver (fixed in CubeU5 1.9.0 / HAL CRYP v1.6.3)
Fixes ZD 22274
Testing
Validated on hardware (NUCLEO-U385RG-Q with the CubeMX HAL crypto driver): AES-GCM known-answer tests with no AAD, 20-byte, 13-byte and 5-byte AAD all pass, byte-identical before and after the change.
Checklist