fix(webauthn): Fix buffer out of bounds

include/TrustWalletCore/TWWebAuthn.h

@@ -24,7 +24,7 @@ struct TWPublicKey *_Nullable TWWebAuthnGetPublicKey(TWData *_Nonnull attestatio
 /// \param signature ASN encoded webauthn signature: https://www.w3.org/TR/webauthn-2/#sctn-signature-attestation-types
 /// \return Concatenated r and s values.
 TW_EXPORT_STATIC_METHOD
-TWData *_Nonnull TWWebAuthnGetRSValues(TWData *_Nonnull signature);
+TWData *_Nullable TWWebAuthnGetRSValues(TWData *_Nonnull signature);
 
 /// Reconstructs the original message that was signed via P256 curve. Can be used for signature validation.
 ///

src/Aeternity/Signer.cpp

@@ -14,8 +14,8 @@ using namespace TW;
 
 namespace TW::Aeternity {
 
-Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto privateKey = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) {
+    auto privateKey = PrivateKey(input.private_key(), TWCurveED25519);
     std::string sender_id = input.from_address();
     std::string recipient_id = input.to_address();
     std::string payload = input.payload();

src/Aeternity/Signer.h

@@ -13,7 +13,7 @@ namespace TW::Aeternity {
 class Signer {
 public:
     /// Signs a Proto::SigningInput transaction
-    static Proto::SigningOutput sign(const Proto::SigningInput& input) noexcept;
+    static Proto::SigningOutput sign(const Proto::SigningInput& input);
 
     /// Signs the given transaction.
     static Proto::SigningOutput sign(const PrivateKey& privateKey, Transaction& transaction);

src/Aion/Signer.cpp

@@ -8,8 +8,8 @@ using namespace TW;
 
 namespace TW::Aion {
 
-Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) {
+    auto key = PrivateKey(input.private_key(), TWCurveED25519);
     auto transaction = Signer::buildTransaction(input);
     Signer::sign(key, transaction);
 
@@ -20,7 +20,7 @@ Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
     return output;
 }
 
-void Signer::sign(const PrivateKey& privateKey, Transaction& transaction) noexcept {
+void Signer::sign(const PrivateKey& privateKey, Transaction& transaction) {
     auto encoded = transaction.encode();
     auto hashData = Hash::blake2b(encoded, 32);
     auto hashSignature = privateKey.sign(hashData);
@@ -33,13 +33,13 @@ void Signer::sign(const PrivateKey& privateKey, Transaction& transaction) noexce
     transaction.signature = result;
 }
 
-TW::Data Signer::signaturePreimage(const Proto::SigningInput& input) noexcept {
+TW::Data Signer::signaturePreimage(const Proto::SigningInput& input) {
     auto transaction = Signer::buildTransaction(input);
     auto encoded = transaction.encode();
     return transaction.encode();
 }
 
-Proto::SigningOutput Signer::compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input) noexcept {
+Proto::SigningOutput Signer::compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input) {
     auto transaction = Signer::buildTransaction(input);
 
     // Aion signature = pubKeyBytes + signatureBytes
@@ -56,7 +56,7 @@ Proto::SigningOutput Signer::compile(const Data& signature, const PublicKey& pub
     return output;
 }
 
-Transaction Signer::buildTransaction(const Proto::SigningInput& input) noexcept {
+Transaction Signer::buildTransaction(const Proto::SigningInput& input) {
     auto transaction = Transaction(
         /* nonce: */ static_cast<uint128_t>(load(input.nonce())),
         /* gasPrice: */ static_cast<uint128_t>(load(input.gas_price())),

src/Aion/Signer.h

@@ -22,18 +22,18 @@ class Signer {
     Signer() = delete;
 
     /// Signs a Proto::SigningInput transaction
-    static Proto::SigningOutput sign(const Proto::SigningInput& input) noexcept;
+    static Proto::SigningOutput sign(const Proto::SigningInput& input);
 
     /// Signs the given transaction.
-    static void sign(const PrivateKey& privateKey, Transaction& transaction) noexcept;
+    static void sign(const PrivateKey& privateKey, Transaction& transaction);
 
     /// Get transaction data to be signed
-    static TW::Data signaturePreimage(const Proto::SigningInput& input) noexcept;
-    static Proto::SigningOutput compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input) noexcept;
+    static TW::Data signaturePreimage(const Proto::SigningInput& input);
+    static Proto::SigningOutput compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input);
 
   private:
     /// Builds an Aion transaction from the given `Proto::SigningInput`.
-    static Transaction buildTransaction(const Proto::SigningInput& input) noexcept;
+    static Transaction buildTransaction(const Proto::SigningInput& input);
 };
 
 } // namespace TW::Aion

src/Algorand/Signer.cpp

@@ -16,9 +16,9 @@ const Data TRANSACTION_TAG = {84, 88};
 const std::string TRANSACTION_PAY = "pay";
 const std::string ASSET_TRANSACTION = "axfer";
 
-Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
+Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) {
     auto protoOutput = Proto::SigningOutput();
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+    auto key = PrivateKey(input.private_key(), TWCurveED25519);
     auto pubkey = key.getPublicKey(TWPublicKeyTypeED25519);
 
     auto preImageData = Signer::preImage(pubkey, input);
@@ -33,24 +33,24 @@ std::string Signer::signJSON(const std::string& json, const Data& key) {
     return hex(Signer::sign(input).encoded());
 }
 
-Data Signer::sign(const PrivateKey& privateKey, const BaseTransaction& transaction) noexcept {
+Data Signer::sign(const PrivateKey& privateKey, const BaseTransaction& transaction) {
     Data data;
     append(data, TRANSACTION_TAG);
     append(data, transaction.serialize());
     auto signature = privateKey.sign(data);
     return {signature.begin(), signature.end()};
 }
 
-TW::Data Signer::signaturePreimage(const Proto::SigningInput& input) noexcept {
+TW::Data Signer::signaturePreimage(const Proto::SigningInput& input) {
     auto pubKey = input.public_key();
     return Signer::preImage(PublicKey(Data(pubKey.begin(), pubKey.end()), TWPublicKeyTypeED25519), input);
 }
 
-Proto::SigningOutput Signer::compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input) noexcept {
+Proto::SigningOutput Signer::compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input) {
     return Signer::encodeTransaction(signature, publicKey, input);
 }
 
-TW::Data Signer::preImage(const TW::PublicKey& pubKey, const Proto::SigningInput& input) noexcept {
+TW::Data Signer::preImage(const TW::PublicKey& pubKey, const Proto::SigningInput& input) {
     auto from = Address(pubKey);
     auto firstRound = input.first_round();
     auto lastRound = input.last_round();
@@ -93,7 +93,7 @@ TW::Data Signer::preImage(const TW::PublicKey& pubKey, const Proto::SigningInput
     return data;
 }
 
-Proto::SigningOutput Signer::encodeTransaction(const Data& signature, const TW::PublicKey& pubKey, const Proto::SigningInput& input) noexcept {
+Proto::SigningOutput Signer::encodeTransaction(const Data& signature, const TW::PublicKey& pubKey, const Proto::SigningInput& input) {
     auto protoOutput = Proto::SigningOutput();
 
     auto from = Address(pubKey);

src/Algorand/Signer.h

@@ -20,21 +20,21 @@ class Signer {
     Signer() = delete;
 
     /// Signs a Proto::SigningInput transaction
-    static Proto::SigningOutput sign(const Proto::SigningInput& input) noexcept;
+    static Proto::SigningOutput sign(const Proto::SigningInput& input);
 
     /// Signs a json Proto::SigningInput with private key
     static std::string signJSON(const std::string& json, const Data& key);
 
     /// Signs the given transaction.
-    static Data sign(const PrivateKey& privateKey, const BaseTransaction& transaction) noexcept;
+    static Data sign(const PrivateKey& privateKey, const BaseTransaction& transaction);
 
     /// Get transaction data to be signed
-    static TW::Data signaturePreimage(const Proto::SigningInput& input) noexcept;
-    static Proto::SigningOutput compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input) noexcept;
+    static TW::Data signaturePreimage(const Proto::SigningInput& input);
+    static Proto::SigningOutput compile(const Data& signature, const PublicKey& publicKey, const Proto::SigningInput& input);
 
   private:
-    static TW::Data preImage(const TW::PublicKey& pubKey, const Proto::SigningInput& input) noexcept;
-    static Proto::SigningOutput encodeTransaction(const Data& signature, const TW::PublicKey& pubKey, const Proto::SigningInput& input) noexcept;
+    static TW::Data preImage(const TW::PublicKey& pubKey, const Proto::SigningInput& input);
+    static Proto::SigningOutput encodeTransaction(const Data& signature, const TW::PublicKey& pubKey, const Proto::SigningInput& input);
 };
 
 } // namespace TW::Algorand

src/Bitcoin/Signer.cpp

@@ -14,15 +14,15 @@
 
 namespace TW::Bitcoin {
 
-Proto::TransactionPlan Signer::plan(const Proto::SigningInput& input) noexcept {
+Proto::TransactionPlan Signer::plan(const Proto::SigningInput& input) {
     if (input.has_signing_v2()) {
         return planAsV2(input);
     }
     auto plan = TransactionSigner<Transaction, TransactionBuilder>::plan(input);
     return plan.proto();
 }
 
-Proto::SigningOutput Signer::sign(const Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs) noexcept {
+Proto::SigningOutput Signer::sign(const Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs) {
     if (input.has_signing_v2()) {
         return signAsV2(input);
     }
@@ -51,7 +51,7 @@ Proto::SigningOutput Signer::sign(const Proto::SigningInput& input, std::optiona
     return output;
 }
 
-Proto::PreSigningOutput Signer::preImageHashes(const Proto::SigningInput& input) noexcept {
+Proto::PreSigningOutput Signer::preImageHashes(const Proto::SigningInput& input) {
     if (input.has_signing_v2()) {
         return preImageHashesAsV2(input);
     }
@@ -76,7 +76,7 @@ Proto::PreSigningOutput Signer::preImageHashes(const Proto::SigningInput& input)
 
 Proto::SigningOutput Signer::compile(const Proto::SigningInput& input,
                                      const std::vector<Data>& signatures,
-                                     const std::vector<PublicKey>& publicKeys) noexcept {
+                                     const std::vector<PublicKey>& publicKeys) {
     if (input.has_signing_v2()) {
         return compileAsV2(input, signatures, publicKeys);
     }

src/Bitcoin/Signer.h

@@ -18,18 +18,18 @@ class Signer {
     Signer() = delete;
 
     /// Returns a transaction plan (utxo selection, fee estimation)
-    static Proto::TransactionPlan plan(const Proto::SigningInput& input) noexcept;
+    static Proto::TransactionPlan plan(const Proto::SigningInput& input);
 
     /// Signs a Proto::SigningInput transaction
-    static Proto::SigningOutput sign(const Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs = {}) noexcept;
+    static Proto::SigningOutput sign(const Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs = {});
 
     /// Collects pre-image hashes to be signed
-    static Proto::PreSigningOutput preImageHashes(const Proto::SigningInput& input) noexcept;
+    static Proto::PreSigningOutput preImageHashes(const Proto::SigningInput& input);
 
     /// Compiles a transaction with the given signatures and public keys.
     static Proto::SigningOutput compile(const Proto::SigningInput& input,
                                         const std::vector<Data>& signatures,
-                                        const std::vector<PublicKey>& publicKeys) noexcept;
+                                        const std::vector<PublicKey>& publicKeys);
 
     /// Plans a transaction via BitcoinV2 protocol (utxo selection, fee estimation).
     static Proto::TransactionPlan planAsV2(const Proto::SigningInput& input) noexcept;

src/BitcoinDiamond/Signer.cpp

@@ -13,12 +13,12 @@
 using namespace TW;
 namespace TW::BitcoinDiamond {
 
-TransactionPlan Signer::plan(const SigningInput& input) noexcept {
+TransactionPlan Signer::plan(const SigningInput& input) {
     auto plan = Bitcoin::TransactionSigner<Transaction, TransactionBuilder>::plan(input);
     return plan.proto();
 }
 
-SigningOutput Signer::sign(const SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs) noexcept {
+SigningOutput Signer::sign(const SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs) {
     SigningOutput output;
     auto result = Bitcoin::TransactionSigner<Transaction, TransactionBuilder>::sign(input, false, optionalExternalSigs);
     if (!result) {
@@ -43,7 +43,7 @@ SigningOutput Signer::sign(const SigningInput& input, std::optional<SignaturePub
     return output;
 }
 
-PreSigningOutput Signer::preImageHashes(const SigningInput& input) noexcept {
+PreSigningOutput Signer::preImageHashes(const SigningInput& input) {
     PreSigningOutput output;
     auto result = Bitcoin::TransactionSigner<Transaction, TransactionBuilder>::preImageHashes(input);
     if (!result) {

src/BitcoinDiamond/Signer.h

@@ -24,13 +24,13 @@ class Signer {
     Signer() = delete;
 
     /// Returns a transaction plan (utxo selection, fee estimation)
-    static TransactionPlan plan(const SigningInput& input) noexcept;
+    static TransactionPlan plan(const SigningInput& input);
 
     /// Signs a Proto::SigningInput transaction
-    static SigningOutput sign(const SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs = {}) noexcept;
+    static SigningOutput sign(const SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs = {});
 
     /// Collect pre-image hashes to be signed
-    static PreSigningOutput preImageHashes(const SigningInput& input) noexcept;
+    static PreSigningOutput preImageHashes(const SigningInput& input);
 };
 
 } // namespace TW::BitcoinDiamond

src/Cbor.cpp

@@ -246,6 +246,11 @@ uint32_t Decode::getTotalLen() const {
     }
 }
 
+Decode::MajorType Decode::getMajorType() const {
+    TypeDesc typeDesc = getTypeDesc();
+    return typeDesc.majorType;
+}
+
 uint64_t Decode::getValue() const {
     TypeDesc typeDesc = getTypeDesc();
     if (typeDesc.majorType != MT_uint && typeDesc.majorType != MT_negint) {
@@ -328,9 +333,9 @@ vector<Decode> Decode::getCompoundElements(uint32_t countMultiplier, TW::byte ex
     return elems;
 }
 
-vector<pair<Decode, Decode>> Decode::getMapElements() const {
+Decode::MapElements Decode::getMapElements() const {
     auto elems = getCompoundElements(2, MT_map);
-    vector<pair<Decode, Decode>> map;
+    MapElements map;
     for (auto i = 0ul; i < elems.size(); i += 2) {
         map.emplace_back(make_pair(elems[i], elems[i + 1]));
     }

src/Cbor.h

@@ -85,9 +85,24 @@ class Decode {
     /// Constructor, create from CBOR byte stream
     Decode(const Data& input);
 
-public: // decoding
+public:
+    enum MajorType {
+        MT_uint = 0,
+        MT_negint = 1,
+        MT_bytes = 2,
+        MT_string = 3,
+        MT_array = 4,
+        MT_map = 5,
+        MT_tag = 6,
+        MT_special = 7,
+    };
+
+    using MapElements = std::vector<std::pair<Decode, Decode>>;
+
     /// Check if contains a valid CBOR byte stream.
     bool isValid() const;
+    // Get the major type
+    MajorType getMajorType() const;
     /// Get the value of a simple type
     uint64_t getValue() const;
     /// Get the value of a string/bytes as string
@@ -97,7 +112,7 @@ class Decode {
     /// Get all elements of array
     std::vector<Decode> getArrayElements() const { return getCompoundElements(1, MT_array); }
     /// Get all elements of map
-    std::vector<std::pair<Decode, Decode>> getMapElements() const;
+    MapElements getMapElements() const;
     /// Get the tag number
     uint64_t getTagValue() const;
     /// Get the tag element
@@ -107,17 +122,6 @@ class Decode {
     uint32_t length() const { return subLen; }
     /// Return encoded form (useful e.g for parsed out sub-parts)
     Data encoded() const;
-
-    enum MajorType {
-        MT_uint = 0,
-        MT_negint = 1,
-        MT_bytes = 2,
-        MT_string = 3,
-        MT_array = 4,
-        MT_map = 5,
-        MT_tag = 6,
-        MT_special = 7,
-    };
 
 private:
     /// Struct used to keep reference to original data

src/Decred/Signer.cpp

@@ -13,7 +13,7 @@
 
 namespace TW::Decred {
 
-Bitcoin::Proto::TransactionPlan Signer::plan(const Bitcoin::Proto::SigningInput& input) noexcept {
+Bitcoin::Proto::TransactionPlan Signer::plan(const Bitcoin::Proto::SigningInput& input) {
     if (input.has_signing_v2()) {
         return Bitcoin::Signer::planAsV2(input);
     }
@@ -22,7 +22,7 @@ Bitcoin::Proto::TransactionPlan Signer::plan(const Bitcoin::Proto::SigningInput&
     return signer.txPlan.proto();
 }
 
-Proto::SigningOutput Signer::sign(const Bitcoin::Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs) noexcept {
+Proto::SigningOutput Signer::sign(const Bitcoin::Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs) {
     if (input.has_signing_v2()) {
         const auto output = Bitcoin::Signer::signAsV2(input);
         Proto::SigningOutput decredOutput;
@@ -52,7 +52,7 @@ Proto::SigningOutput Signer::sign(const Bitcoin::Proto::SigningInput& input, std
     return output;
 }
 
-Bitcoin::Proto::PreSigningOutput Signer::preImageHashes(const Bitcoin::Proto::SigningInput& input) noexcept {
+Bitcoin::Proto::PreSigningOutput Signer::preImageHashes(const Bitcoin::Proto::SigningInput& input) {
     if (input.has_signing_v2()) {
         return Bitcoin::Signer::preImageHashesAsV2(input);
     }

src/Decred/Signer.h

@@ -33,13 +33,13 @@ enum SigningMode {
 class Signer {
   public:
     /// Returns a transaction plan (utxo selection, fee estimation)
-    static Bitcoin::Proto::TransactionPlan plan(const Bitcoin::Proto::SigningInput& input) noexcept;
+    static Bitcoin::Proto::TransactionPlan plan(const Bitcoin::Proto::SigningInput& input);
 
     /// Signs a Proto::SigningInput transaction
-    static Proto::SigningOutput sign(const Bitcoin::Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs = {}) noexcept;
+    static Proto::SigningOutput sign(const Bitcoin::Proto::SigningInput& input, std::optional<SignaturePubkeyList> optionalExternalSigs = {});
 
     /// Collect pre-image hashes to be signed
-    static Bitcoin::Proto::PreSigningOutput preImageHashes(const Bitcoin::Proto::SigningInput& input) noexcept;
+    static Bitcoin::Proto::PreSigningOutput preImageHashes(const Bitcoin::Proto::SigningInput& input);
 
   private:
     /// Private key and redeem script provider for signing.