From 42d0bb319323e8313cdd5b890e082046d423e6ee Mon Sep 17 00:00:00 2001 From: JacobBarthelmeh Date: Tue, 16 Jun 2026 14:48:35 -0600 Subject: [PATCH] additional sanity check on input arguments --- tests/api/test_evp.c | 12 ++++++++++++ wolfcrypt/src/evp.c | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/tests/api/test_evp.c b/tests/api/test_evp.c index 172bf3d2c1..109a508030 100644 --- a/tests/api/test_evp.c +++ b/tests/api/test_evp.c @@ -385,6 +385,18 @@ int test_wolfSSL_EVP_DecodeUpdate(void) ); ExpectIntEQ( outl, 0); + /* pass negative length */ + ExpectIntEQ( + EVP_DecodeUpdate( + ctx, + decOutBuff, + &outl, + enc1, + -1), /* negative inl */ + -1 /* expected result code -1: fail */ + ); + ExpectIntEQ( outl, 0); + ExpectIntEQ(EVP_DecodeBlock(NULL, NULL, 0), -1); /* pass zero length input */ diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c index 5001288338..7851e9d842 100644 --- a/wolfcrypt/src/evp.c +++ b/wolfcrypt/src/evp.c @@ -13457,7 +13457,7 @@ int wolfSSL_EVP_DecodeUpdate(WOLFSSL_EVP_ENCODE_CTX* ctx, if (outl == NULL) return -1; - if (ctx == NULL || out == NULL || in == NULL) { + if (ctx == NULL || out == NULL || in == NULL || inl < 0) { *outl = 0; return -1; }