From fb8efa4ec8164e4cd70cc6eb54240f35cc38d23a Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Thu, 16 Jul 2026 08:47:02 +0000
Subject: [PATCH] Validate NULL parameters in wc_AesCbcEncryptWithKey (F-1376)

wc_AesCbcEncryptWithKey did not check out/in/key/iv for NULL before calling
wc_AesSetKey/wc_AesCbcEncrypt, unlike its counterpart wc_AesCbcDecryptWithKey.
A NULL key can reach wc_AesSetKey implementations that XMEMCPY userKey without
a NULL guard (e.g. the STM32 path), causing a crash at the API boundary.

Add the same NULL guard wc_AesCbcDecryptWithKey uses.
---
 wolfcrypt/src/wc_encrypt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/wolfcrypt/src/wc_encrypt.c b/wolfcrypt/src/wc_encrypt.c
index 240011ac04..d91ffed1e6 100644
--- a/wolfcrypt/src/wc_encrypt.c
+++ b/wolfcrypt/src/wc_encrypt.c
@@ -74,6 +74,10 @@ int wc_AesCbcEncryptWithKey(byte* out, const byte* in, word32 inSz,
     int  ret = 0;
     WC_DECLARE_VAR(aes, Aes, 1, 0);
 
+    if (out == NULL || in == NULL || key == NULL || iv == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
     WC_ALLOC_VAR_EX(aes, Aes, 1, NULL, DYNAMIC_TYPE_TMP_BUFFER,
         return MEMORY_E);