From f063721fac5d72eecc31c966059a567a9730d59b Mon Sep 17 00:00:00 2001
From: jordan <jordan@wolfssl.com>
Date: Tue, 9 Jun 2026 12:27:08 -0500
Subject: [PATCH] dsa: check that key was created before export.

---
 tests/api/test_dsa.c | 3 +++
 wolfcrypt/src/dsa.c  | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/tests/api/test_dsa.c b/tests/api/test_dsa.c
index bfdc08e212..5f239dbe92 100644
--- a/tests/api/test_dsa.c
+++ b/tests/api/test_dsa.c
@@ -555,6 +555,9 @@ int test_wc_DsaExportKeyRaw(void)
     ExpectIntEQ(wc_InitDsaKey(&key), 0);
     ExpectIntEQ(wc_InitRng(&rng), 0);
     ExpectIntEQ(wc_MakeDsaParameters(&rng, 1024, &key), 0);
+    /* export before make key should return error. */
+    ExpectIntEQ(wc_DsaExportKeyRaw(&key, xOut, &xOutSz, yOut, &yOutSz),
+                WC_NO_ERR_TRACE(BAD_FUNC_ARG));
     ExpectIntEQ(wc_MakeDsaKey(&rng, &key), 0);
 
     /* try successful export */
diff --git a/wolfcrypt/src/dsa.c b/wolfcrypt/src/dsa.c
index 5df809c2da..a504b43267 100644
--- a/wolfcrypt/src/dsa.c
+++ b/wolfcrypt/src/dsa.c
@@ -709,6 +709,11 @@ int wc_DsaExportKeyRaw(DsaKey* dsa, byte* x, word32* xSz, byte* y, word32* ySz)
     if (dsa == NULL || xSz == NULL || ySz == NULL)
         return BAD_FUNC_ARG;
 
+    /* check we have a key to export */
+    if (mp_iszero(&dsa->x) || mp_iszero(&dsa->y)) {
+        return BAD_FUNC_ARG;
+    }
+
     /* get required output buffer sizes */
     xLen = (word32)mp_unsigned_bin_size(&dsa->x);
     yLen = (word32)mp_unsigned_bin_size(&dsa->y);