From c3c705f82b0021ef61abf3d6d205755db2e7b7cd Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 16 Jul 2019 15:44:14 -0700
Subject: [PATCH 1/3] FIPS, HMAC, and PKCS8 One of the tests for PKCS8 depended
 on keys encrypted with a password that has only 8 letters. HMAC in FIPS mode
 requires a minimum of 12 bytes. Disabled that test case when FIPS is enabled.
 All components do get tested just not all together in that case.

---
 tests/api.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/api.c b/tests/api.c
index 672a54096..19389f6fb 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -20664,6 +20664,10 @@ static void test_wolfSSL_PKCS8_Compat(void)
 
 static void test_wolfSSL_PKCS8_d2i(void)
 {
+#ifndef WOLFSSL_FIPS
+    /* This test ends up using HMAC as a part of PBKDF2, and HMAC
+     * requires a 12 byte password in FIPS mode. This test ends up
+     * trying to use an 8 byte password. */
 #ifdef OPENSSL_ALL
     WOLFSSL_EVP_PKEY* pkey = NULL;
 #ifndef NO_FILESYSTEM
@@ -20817,6 +20821,7 @@ static void test_wolfSSL_PKCS8_d2i(void)
 
     printf(resultFmt, passed);
 #endif
+#endif /* WOLFSSL_FIPS */
 }
 
 static void test_wolfSSL_ERR_put_error(void)

From 9c245b7fc597cc428ae630c2cf0a2a182bbd1a56 Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 16 Jul 2019 15:44:45 -0700
Subject: [PATCH 2/3] Fixes When building with GCC-8 and enable-intelasm set,
 GCC reported a memcpy from and two the same pointer being possible. Added a
 check for the same pointer and skipped the copy if the same.

---
 wolfcrypt/src/aes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c
index e12a2d258..1d246cb6d 100644
--- a/wolfcrypt/src/aes.c
+++ b/wolfcrypt/src/aes.c
@@ -1628,7 +1628,8 @@ static void wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
         #endif
 
         /* if input and output same will overwrite input iv */
-        XMEMCPY(aes->tmp, inBlock, AES_BLOCK_SIZE);
+        if ((const byte*)aes->tmp != inBlock)
+            XMEMCPY(aes->tmp, inBlock, AES_BLOCK_SIZE);
         AES_ECB_decrypt(inBlock, outBlock, AES_BLOCK_SIZE, (byte*)aes->key,
                         aes->rounds);
         return;

From 3aad9a26730f0ba000d85e0b68d90b35033d7c2a Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 16 Jul 2019 16:22:36 -0700
Subject: [PATCH 3/3] FIPS Macro Fix In a couple places the label WOLFSSL_FIPS
 was getting checked. Changed to the correct HAVE_FIPS instead.

---
 tests/api.c         | 6 +++---
 wolfcrypt/src/rsa.c | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/api.c b/tests/api.c
index 19389f6fb..9cebfe6a7 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -11341,7 +11341,7 @@ static int test_wc_RsaPublicKeyDecodeRaw (void)
     /* In FIPS builds, wc_MakeRsaKey() will return an error if it cannot find
      * a probable prime in 5*(modLen/2) attempts. In non-FIPS builds, it keeps
      * trying until it gets a probable prime. */
-    #ifdef WOLFSSL_FIPS
+    #ifdef HAVE_FIPS
         static int MakeRsaKeyRetry(RsaKey* key, int size, long e, WC_RNG* rng)
         {
             int ret;
@@ -20664,7 +20664,7 @@ static void test_wolfSSL_PKCS8_Compat(void)
 
 static void test_wolfSSL_PKCS8_d2i(void)
 {
-#ifndef WOLFSSL_FIPS
+#ifndef HAVE_FIPS
     /* This test ends up using HMAC as a part of PBKDF2, and HMAC
      * requires a 12 byte password in FIPS mode. This test ends up
      * trying to use an 8 byte password. */
@@ -20821,7 +20821,7 @@ static void test_wolfSSL_PKCS8_d2i(void)
 
     printf(resultFmt, passed);
 #endif
-#endif /* WOLFSSL_FIPS */
+#endif /* HAVE_FIPS */
 }
 
 static void test_wolfSSL_ERR_put_error(void)
diff --git a/wolfcrypt/src/rsa.c b/wolfcrypt/src/rsa.c
index ecb8a7294..78b69f6ff 100644
--- a/wolfcrypt/src/rsa.c
+++ b/wolfcrypt/src/rsa.c
@@ -3654,7 +3654,7 @@ int wc_MakeRsaKey(RsaKey* key, int size, long e, WC_RNG* rng)
             if (err == MP_OKAY)
                 err = _CheckProbablePrime(&p, NULL, &tmp3, size, &isPrime, rng);
 
-#ifdef WOLFSSL_FIPS
+#ifdef HAVE_FIPS
             i++;
 #else
             /* Keep the old retry behavior in non-FIPS build. */
@@ -3689,7 +3689,7 @@ int wc_MakeRsaKey(RsaKey* key, int size, long e, WC_RNG* rng)
             if (err == MP_OKAY)
                 err = _CheckProbablePrime(&p, &q, &tmp3, size, &isPrime, rng);
 
-#ifdef WOLFSSL_FIPS
+#ifdef HAVE_FIPS
             i++;
 #else
             /* Keep the old retry behavior in non-FIPS build. */