From 42bbbda087f271ae3f4d0043e769f4e86ab91c24 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Fri, 10 Jul 2026 12:12:52 +0200 Subject: [PATCH] tests/rsa: run bad-size wc_MakeRsaKey checks under WOLFSSL_CHECK_MEM_ZERO The mem-zero false-positive these calls tripped is fixed at the library level in wc_MakeRsaKey() on the sibling branch (fixes-2026-07-10 / PR 10875), which zero-initializes its stack temporaries so the early-out mp_memzero_check() is safe. Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the RsaSizeCheck decision is exercised in the instrumented build too. Depends on PR 10875 for the all-check-mem-zero config. --- tests/api/test_rsa.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/tests/api/test_rsa.c b/tests/api/test_rsa.c index ade114e01d..8d17d56109 100644 --- a/tests/api/test_rsa.c +++ b/tests/api/test_rsa.c @@ -1610,18 +1610,11 @@ int test_wc_RsaDecisionCoverage(void) /* ---- wc_MakeRsaKey size check: RsaSizeCheck (rsa.c line ~5153) ---- * size < RSA_MIN_SIZE and size > RSA_MAX_SIZE both reject; the valid-size - * (all-false) side came from the MAKE_RSA_KEY above. - * Skipped under WOLFSSL_CHECK_MEM_ZERO: on the early size-check failure - * wc_MakeRsaKey runs mp_memzero_check() over its not-yet-initialized local - * temporaries, which over-scans the stack and false-positives on the - * still-registered (legitimately non-zero) key->d of the key made above. - * The decision itself is covered in every non-instrumented build. */ -#ifndef WOLFSSL_CHECK_MEM_ZERO + * (all-false) side came from the MAKE_RSA_KEY above. */ ExpectIntEQ(wc_MakeRsaKey(&key, RSA_MIN_SIZE - 1, WC_RSA_EXPONENT, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); ExpectIntEQ(wc_MakeRsaKey(&key, RSA_MAX_SIZE + 1, WC_RSA_EXPONENT, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); -#endif /* ---- wc_CheckProbablePrime_ex argument checks (rsa.c ~5286/~5293) ---- */ {