Alignment and vendor port hardening

[dgarske]

Alignment and vendor port hardening

Part 1 of 4 from an internal automated source review. Independent of the other three; no shared files.

Report	Summary
F-1394	Bitsliced AES key expansion word access
F-1971	scrypt word access
F-3344	SHA-256 block hash word access
F-3080	STM32 CRYP AES path word access
F-3081	STM32 CRYP DES path word access
F-3345	Renesas SCE AES path word access
F-603	CryptoCell RSA hash mode selection when a hash is compiled out

Word-sized accesses were being made through caller-supplied byte pointers that carry no alignment guarantee. Each is now staged through an aligned local or routed via the unaligned accessors in misc.c. The Renesas SCE change additionally stops the helper writing to its const input buffer.

The CryptoCell change is unrelated to alignment: each case of the RSA hash-mode switch had its return inside a #ifdef with no per-case fallback, so a compiled-out algorithm fell through to the next one rather than reporting an error.

Testing

make check passes on --enable-all, --enable-all --enable-lms, and --enable-aes-bitsliced --enable-scrypt --enable-lms.

New test: SHA-256 block hashing at an unaligned offset (tests/api/test_sha256.c).

The vendor paths have no host build, so they were validated with off-target harnesses that compile the shipped functions against stubbed peripherals and drive them through every buffer misalignment and every hash-algorithm define combination. Each harness was confirmed to fail against the pre-fix code. They live on the fenrir_align_ports_offtarget_test branch, which is scaffolding and not intended for merge.

One caveat worth stating: the three portable alignment fixes cannot be shown failing on a host where WOLFSSL_USE_ALIGN is auto-defined, because ByteReverseWords() already takes its safe path there. They are correct by construction and the new test guards digest equality, but reproducing the original fault needs a strict-alignment target.

[Copilot]

Pull request overview

This PR hardens several wolfCrypt portable and vendor-port code paths against unaligned word accesses (and one const-correctness issue), and fixes a CryptoCell RSA hash-mode selection fall-through when specific hash algorithms are compiled out.

Changes:

• SHA-256: stage caller-supplied block data through an aligned buffer before word-reversal in wc_Sha256HashBlock(), and add an API test that validates hashing at unaligned offsets.
• scrypt + bitsliced AES: replace direct word pointer casts on byte arrays with the existing unaligned accessors from misc.c.
• Vendor ports (STM32 CRYP, CryptoCell): introduce aligned staging helpers for CRYP word I/O, and ensure RSA hash-mode selection returns a not-known mode instead of falling through when algorithms are disabled.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wolfcrypt/src/sha256.c	Copies caller block into aligned buffer before ByteReverseWords() to avoid unaligned reads in wc_Sha256HashBlock().
wolfcrypt/src/pwdbased.c	Uses readUnalignedWord32/64() for scrypt’s index word read instead of direct casts.
wolfcrypt/src/port/arm/cryptoCell.c	Prevents switch fall-through by assigning/breaking per case and returning a “not known” hash mode when compiled-out.
wolfcrypt/src/des3.c	Adds an aligned staging helper for STM32 CRYP DES block I/O, replacing unaligned word dereferences.
wolfcrypt/src/aes.c	Adds an aligned staging helper for STM32 CRYP AES block I/O; uses unaligned accessors for bitsliced AES key expansion; stages SCE ECB buffers through aligned locals.
tests/api/test_sha256.h	Registers the new SHA-256 unaligned hash-block API test.
tests/api/test_sha256.c	Adds test_wc_Sha256HashBlock_unaligned() to validate equal digests across aligned vs. unaligned block pointers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[dgarske]

Jenkins retest this please. aarch64 test timeout