From f140546ba16ef062f53d171744123af9631ea9d9 Mon Sep 17 00:00:00 2001
From: JacobBarthelmeh <jacob@wolfssl.com>
Date: Wed, 6 May 2026 08:34:50 -0600
Subject: [PATCH] add sanity check of hash to atmel port

---
 wolfcrypt/src/port/atmel/atmel.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/wolfcrypt/src/port/atmel/atmel.c b/wolfcrypt/src/port/atmel/atmel.c
index 08bbc2f664..fd0855ddd4 100644
--- a/wolfcrypt/src/port/atmel/atmel.c
+++ b/wolfcrypt/src/port/atmel/atmel.c
@@ -467,6 +467,16 @@ int atmel_ecc_create_key(int slotId, byte* peerKey)
 int atmel_ecc_sign(int slotId, const byte* message, byte* signature)
 {
     int ret;
+#ifndef WC_ALLOW_ECC_ZERO_HASH
+    byte hashIsZero = 0;
+    word32 zIdx;
+
+    /* defensive sanity check on all 0's hash */
+    for (zIdx = 0; zIdx < ATECC_KEY_SIZE; zIdx++)
+        hashIsZero |= message[zIdx];
+    if (hashIsZero == 0)
+        return ECC_BAD_ARG_E;
+#endif
 
     ret = atcab_sign(slotId, message, signature);
     ret = atmel_ecc_translate_err(ret);