From 1d8308c77c45715f67e4c5eb75c4d450f077e150 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 8 Oct 2026 10:04:12 +0200 Subject: [PATCH] ecc: keep ECC_MAXSIZE at least MAX_ECC_BYTES ECC_MAXSIZE was fixed at 66 bytes without SAKKE, while MAX_ECC_BYTES follows MAX_ECC_BITS, which --with-max-ecc-bits and the CMake WOLFSSL_MAX_ECC_BITS option can raise to 1024. Such a build had MAX_ECC_BYTES of 128 against an ECC_MAXSIZE of 66, so curves the build was sized for were still refused by wc_ecc_set_curve() and the ECC_MAXSIZE buffers were smaller than the curve size. Grow ECC_MAXSIZE and ECC_MAXSIZE_GEN with MAX_ECC_BYTES when it exceeds 66, and add a static assert so the two cannot drift apart again, for example through a MAX_ECC_BITS override past SAKKE's 128 bytes. --- wolfssl/wolfcrypt/ecc.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/wolfssl/wolfcrypt/ecc.h b/wolfssl/wolfcrypt/ecc.h index d4ace6da027..ea59605f216 100644 --- a/wolfssl/wolfcrypt/ecc.h +++ b/wolfssl/wolfcrypt/ecc.h @@ -185,6 +185,9 @@ enum { #ifdef WOLFCRYPT_HAVE_SAKKE ECC_MAXSIZE = 128, /* MAX Private Key size */ ECC_MAXSIZE_GEN = 128, /* MAX Buffer size required when generating ECC keys*/ +#elif MAX_ECC_BYTES > 66 + ECC_MAXSIZE = MAX_ECC_BYTES, + ECC_MAXSIZE_GEN = MAX_ECC_BYTES + 8, #else ECC_MAXSIZE = 66, /* MAX Private Key size */ ECC_MAXSIZE_GEN = 74, /* MAX Buffer size required when generating ECC keys*/ @@ -238,6 +241,7 @@ enum { WOLF_ENUM_DUMMY_LAST_ELEMENT(ECC) }; +wc_static_assert(MAX_ECC_BYTES <= ECC_MAXSIZE); #endif /* HAVE_ECC */