From a453136cc976d53cd1cbc3bd371b0a5eee741fb4 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Thu, 9 Jul 2026 23:53:56 +0200 Subject: [PATCH] tests: cover the AES-EAX streaming Update authIn arg-check test_wc_AesEaxArgMcdc exercised the eax/out/in operands of wc_AesEaxEncryptUpdate / wc_AesEaxDecryptUpdate but always passed (authIn=NULL, authInSz=0), so the guard's authInSz>0 && authIn==NULL term was never evaluated with authInSz>0 -- leaving those two conditions (and their decrypt twins) uncovered in the MC/DC union. Add, for both Update functions, the (authIn==NULL, authInSz>0) row (rejected with BAD_FUNC_ARG) and the (authIn!=NULL, authInSz>0) row (accepted), completing both conditions' independence pairs. These four conditions were the only uncovered code the recent master merge (AES-GCM-SIV, AES-OFB/CFB callbacks) added to aes.c that was reachable from tests/api; closes them so the aes.c union returns to its residual-only gap (410/445, gap 35). --- tests/api/test_aes.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/api/test_aes.c b/tests/api/test_aes.c index 505935a8aa..eeb379a6c9 100644 --- a/tests/api/test_aes.c +++ b/tests/api/test_aes.c @@ -8076,6 +8076,14 @@ int test_wc_AesEaxArgMcdc(void) /* cond: in == NULL */ ExpectIntEQ(wc_AesEaxEncryptUpdate(&eax, out, NULL, sizeof(in), NULL, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); + /* cond: authInSz > 0 && authIn == NULL -> BAD_FUNC_ARG (both the + * authInSz>0 and authIn==NULL conditions true). */ + ExpectIntEQ(wc_AesEaxEncryptUpdate(&eax, out, in, sizeof(in), NULL, + sizeof(in)), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); + /* cond: authInSz > 0 && authIn != NULL -> valid (authIn==NULL false while + * authInSz>0 true), completing that pair. */ + ExpectIntEQ(wc_AesEaxEncryptUpdate(&eax, out, in, sizeof(in), in, + sizeof(in)), 0); ExpectIntEQ(wc_AesEaxFree(&eax), 0); /* ---- wc_AesEaxDecryptUpdate(): eax/out/in OR-chain ---- */ @@ -8093,6 +8101,12 @@ int test_wc_AesEaxArgMcdc(void) /* cond: in == NULL */ ExpectIntEQ(wc_AesEaxDecryptUpdate(&eax, out, NULL, sizeof(in), NULL, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); + /* cond: authInSz > 0 && authIn == NULL -> BAD_FUNC_ARG. */ + ExpectIntEQ(wc_AesEaxDecryptUpdate(&eax, out, in, sizeof(in), NULL, + sizeof(in)), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); + /* cond: authInSz > 0 && authIn != NULL -> valid, completing the pair. */ + ExpectIntEQ(wc_AesEaxDecryptUpdate(&eax, out, in, sizeof(in), in, + sizeof(in)), 0); ExpectIntEQ(wc_AesEaxFree(&eax), 0); /* ---- wc_AesEaxEncryptFinal(): authTag == NULL / authTagSz == 0 ---- */