test_pkcs7.c: test_wc_PKCS7_BER also accepts ret >= 0 (Bleichenbacher mitigation hides the RSA key error, making the result non-deterministic).
suites.c: skip --send-ticket cases as NOT_BUILT_IN when HAVE_SESSION_TICKET
is off (avoids port-11111 race).
wc_RsaFunction is declared WOLFSSL_API but the FIPS module does not export
it, so test_wc_RsaDecisionCoverage's 7-condition wc_RsaFunction arg-check
block fails to link (undefined reference) across the FIPS legs. Exclude the
block under HAVE_FIPS; cipher/plain/key/rng stay used by the other checks,
so no unused-variable. Not frozen under self-test, so it stays there.
The frozen FIPS/self-test hmac's wc_HmacSizeByType returns HMAC_KAT_FIPS_E
(-206) for any type it doesn't accept - not just the invalid 9999 case but
also MD5 (not a FIPS HMAC type), which returned -206 instead of the digest
size. Rather than chase each type, exclude the whole function under
HAVE_SELFTEST/HAVE_FIPS (the campaign measures MC/DC on open builds only).
- test_cmac.c: wc_AesCmacGenerate_ex / wc_AesCmacVerify_ex are absent from
the frozen FIPS cmac.h (fips-check freezes cmac.h at WCv4-stable /
WCv5.0-RC12 / v5.2.1-stable, none of which declare the _ex variants), so
the DecisionCoverage + cryptocb tests calling them fail to compile on the
FIPS legs. Add !defined(HAVE_FIPS) to their guards. cmac is NOT frozen
under CAVP self-test, so no HAVE_SELFTEST clause is needed.
- test_random.c: the WC_RNG_SEED_CB callbacks (test_random_seedCb_ok/_fail)
were guarded #ifdef WC_RNG_SEED_CB, but their only caller test_wc_RNG_SeedCb
is additionally !HAVE_SELFTEST && !HAVE_FIPS; a fips-ready build with
WC_RNG_SEED_CB on compiled the statics but not the caller ->
-Werror=unused-function. Match the statics' guard to the caller's.
- test_dh.c: zero-initialize priv/pub in test_wc_DhCheckKeyPair. clang-tidy
flags pub[pubSz-1] ^= 0x01 as a read of an uninitialized variable (it
cannot see that wc_DhGenerateKeyPair fills pub at runtime), failing
all-c89-clang-tidy / clang-tidy-all-intelasm / clang-tidy-all-async-quic.
- test_curve25519_whitebox.c: wrap the BAD_FUNC_ARG operands in
WC_NO_ERR_TRACE() (check-source-text unescaped-error-code check).
- test_sha3_whitebox.c: drop the bogus WOLFSSL_NO_SHA3 guard (no such
macro; the real gate is WOLFSSL_SHA3), which check-source-text reported
as an unknown macro.
test_wc_SpIntExptGcdDecisionCoverage sized r with sp_init_size(&r, 2)
expecting sp_gcd(2^140, 2^70, &r) == 0, on the assumption that 2^70
occupies 2 digits. That only holds for 64-bit SP_WORD_SIZE; on a 32-bit
build (e.g. --enable-sp-math-all with ALT_ECC_SIZE under -m32) 2^70 spans
3 digits, so r->size(2) < b->used(3) trips sp_gcd's dest-size check and it
returns MP_VAL. Size r to b.used so the "r->size < b->used" operand stays
false (the intended MC/DC pair) for any word size.
test_wc_CmacFinal declares tooSmallMacSz but only uses it inside the
"#if (!HAVE_FIPS || FIPS>=5.3) && !HAVE_SELFTEST" block (wc_CmacFinalNoFree
bad-arg checks). Under the CAVP-selftest config that block is compiled out,
leaving the variable unused -> -Werror=unused-variable. Declare it under the
same condition as its use.
The CAVP-selftest-v2 CI leg configures with --enable-dsa --enable-keygen
(richer than the minimal selftest profile), so it compiles two more
functions that call wolfCrypt APIs absent from the frozen v4.1.0 module:
- test_wc_DsaSign_bad_digestSz -> wc_DsaSign_ex / wc_DsaVerify_ex
- test_wc_DhGenerateParams_and_ExportRaw -> wc_DhGenerateParams /
wc_DhExportParamsRaw
Exclude both from HAVE_SELFTEST / HAVE_FIPS builds. Only a frozen build
run under the CAVP config (DSA + keygen on) exposes these.
test_wc_EccDecisionCoverage3 calls wc_ecc_import_unsigned and
wc_ecc_rs_raw_to_sig, which are not available in the frozen
CAVP-selftest wolfCrypt module (their declarations are gated off by the
minimal selftest feature config), so the CAVP-selftest CI leg fails to
compile them under -Werror. Exclude the function from HAVE_SELFTEST /
HAVE_FIPS builds, matching the sibling EccDecisionCoverage functions.
This class is only visible via an actual --enable-selftest compile, not
a header symbol diff.
The FIPS and CAVP-selftest CI legs overlay an ancient frozen wolfCrypt
per module (selftest ~= wc 4.1.0; FIPS v2 = WCv4-stable, older still).
New MC/DC tests call post-freeze wc_* APIs absent from those modules,
which fails to compile under -Werror on those legs. The campaign only
measures MC/DC on open per-module builds, never on FIPS/selftest, so
these functions gain no coverage there and only risk breaking CI.
Guard every affected test function with
!defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) so it compiles out in
frozen builds, determined by diffing each header against both
v4.1.0-stable (selftest) and WCv4-stable (oldest FIPS v2):
- test_dh.c: SetNamedKey/CheckPubKey/CheckPrivKey/CheckKeyPair/
GenerateKeyPair* /Agree/ImportExport/SetKey (named-key, FFDHE,
DhAgree_ct, DhGeneratePublic, DhSetCheckKey - the last v2-only)
- test_ecc.c: mulmod + EccDecisionCoverage/2/4 (key_get_priv,
import_point_der_ex, gen_k, init_label, ctx_set_kdf_salt, ...)
- test_dsa.c: DsaKeyToPublicDer (add FIPS clause to existing selftest guard)
- test_hmac.c: HmacInit_Label, HmacInit_Id (wc_HmacInit_Id v2-only)
- test_random.c: RNG_SeedCb (wc_SetSeed_Cb)
- test_rsa.c: RsaFeatureCoverage (wc_InitRsaKey_Label)
- test_sha512.c: sha512 cryptocb fallback / default-devid variants
test_aes.c already handles this via per-feature guards (PR #10845).
Open build stays warning-clean and all guarded tests still run there.
Two MC/DC tests asserted pre-fix behavior; the corresponding library
fixes changed the observable result:
- test_wc_DsaImportParamsRaw_individual_args: the untrusted-import
primality rejection now surfaces DH_CHECK_PUB_E, since CheckDsaLN is
gated on err==MP_OKAY (commit 30ceba03c) and no longer overwrites it
with BAD_FUNC_ARG.
- test_wc_curve25519_check_public_be: the big-endian "order or higher"
loop now compares pub[i] != 0xff (symmetric with the little-endian
branch, commit 600880a0a), so the rejection input needs pub[1..30]
== 0xff, not 0x00.
Updated the assertions and the now-stale explanatory comments. Both
groups pass under --enable-all --enable-intelasm; full make check green.
The mem-zero false-positive these calls tripped is fixed at the library
level in wc_MakeRsaKey() on the sibling branch (fixes-2026-07-10 / PR
10875), which zero-initializes its stack temporaries so the early-out
mp_memzero_check() is safe. Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the
RsaSizeCheck decision is exercised in the instrumented build too. Depends
on PR 10875 for the all-check-mem-zero config.
The mem-zero registration leak this guard worked around is fixed at the
library level in wc_FreeDhKey() on the sibling branch (fixes-2026-07-10 /
PR 10875). Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the import/export test
runs and validates that fix. This test therefore depends on PR 10875 to
pass the all-check-mem-zero CI config.
test_wc_DhGenerateParams_and_ExportRaw asserted wc_DhGenerateParams()==0,
but the bare WOLFSSL_SP_MATH backend cannot generate DH domain parameters
(returns PRIME_GEN_E), so the all-pq-sp-math CI config (--enable-sp-math)
failed the assertion. Guard the test on !defined(WOLFSSL_SP_MATH); the
generate/export decisions are covered with WOLFSSL_SP_MATH_ALL, fastmath
and heapmath. Verified: --enable-sp-math unit.test passes (test skipped);
the test still runs under --enable-all.
The all-check-mem-zero CI config (--enable-all -DWOLFSSL_CHECK_MEM_ZERO)
aborted unit.test (exit 134) in two of the new decision-coverage tests.
Both stem from wolfSSL mem-zero-tracking gaps that these tests are the
first to exercise; the underlying decisions are covered in every normal
build, so guard the specific triggers out of the instrumented build:
- test_rsa.c (test_wc_RsaDecisionCoverage): calling wc_MakeRsaKey() with an
out-of-range size makes it 'goto out' and run mp_memzero_check() over its
not-yet-initialized local temporaries, which over-scans the stack and
false-positives on the still-registered, legitimately non-zero key->d of
the key made earlier in the test. Skip the two bad-size calls under the
instrumented build.
- test_dh.c (test_wc_DhImportExportKeyPair): wc_DhImportKeyPair() registers
key->priv via mp_memzero_add(), but wc_FreeDhKey() clears it with
mp_forcezero() (which does not deregister) and has no wc_MemZero_Check()
like wc_FreeRsaKey() does, so the registration leaks into later tests.
Skip this import/export test under the instrumented build.
Verified: --enable-all -DWOLFSSL_CHECK_MEM_ZERO builds and unit.test passes
(exit 0, zero mem-zero violations).
The sp_int helper functions these tests call have varied, narrow definition
guards in sp_int.c (e.g. sp_div_2d/sp_mod_2d/sp_mul_2d/sp_tohex need
WOLFSSL_SP_MATH_ALL && !WOLFSSL_RSA_VERIFY_ONLY; the ct helpers need HAVE_ECC;
sp_gcd needs !NO_RSA && WOLFSSL_KEY_GEN). The previous
(WOLFSSL_SP_MATH_ALL || WOLFSSL_SP_MATH) && WOLFSSL_PUBLIC_MP guard let the
tests compile in configs where some of those helpers are not built, producing
undefined-reference link errors (sp_gcd, sp_div_2d, ...) in builds like
--enable-curl and the pq-small matrix configs. Replace it with the union of
the helpers' requirements, which the campaign sp-math config satisfies so
coverage is unchanged, and drop the now-redundant per-call sp_gcd guard.
Three more config-specific failures surfaced once the ecc link error was
resolved:
- test_wolfmath.c: test_wc_SpIntExptGcdDecisionCoverage called sp_gcd, whose
definition (sp_int.c) is guarded by !NO_RSA && WOLFSSL_KEY_GEN - narrower
than its sp_int.h prototype (|| ). Guard the sp_gcd block with the same
condition so builds like --enable-curl (RSA on, key-gen off) link.
- test_cmac.c: the crypto-cb badlen callback dereferences wc_CryptoInfo's
cmac member (WOLFSSL_CMAC only) and uses the Cmac type, but was guarded by
WOLF_CRYPTO_CB alone; configs with the callback framework but no CMAC
(e.g. --enable-wolftpm) failed to compile. Match the callback's guard to
its only caller (WOLFSSL_CMAC && !NO_AES && WOLFSSL_AES_128 &&
WOLF_CRYPTO_CB).
- test_dsa.c: test_wc_DsaExportKeyRaw_individual_args re-initialized WC_RNG
three times but freed it once, leaking two DRBGs (caught by LeakSanitizer
in the --enable-all sanitizer build). Free the RNG before each re-init,
mirroring the existing DsaKey free-before-reinit.
Verified: --enable-curl and --enable-wolftpm build/link; --enable-all with
-fsanitize=leak runs unit.test leak-free (test_wc_DsaExportKeyRaw_individual_args
passes).
test_wc_EccDecisionCoverage2 broke the unit.test link in several CI
configs (net-snmp, C#/Rust wrappers, make check/analyze, etc.):
- The wc_ecc_check_r_s_range block calls mp_init/mp_read_radix/mp_copy/
mp_clear, which resolve to sp_* under WOLFSSL_SP_MATH_ALL and are only
exported with WOLFSSL_PUBLIC_MP. Add defined(WOLFSSL_PUBLIC_MP) to its
guard (matching the other mp_*-using blocks in this file).
- wc_ecc_export_point_der_compressed is WOLFSSL_LOCAL (hidden in a shared
library) so it is not linkable from the shared-library unit test. Drop
the four direct calls; its decision coverage is driven by the ecc
white-box (which includes ecc.c). The public compressed path
wc_ecc_export_x963_ex(...,1) is retained.
Verified: --enable-net-snmp and --enable-all (+WOLFSSL_PUBLIC_MP) both
build and link; unit.test passes.
BEFORE 15/65 (23.08%) -> AFTER 55/65 (84.62%) MC/DC on wolfcrypt/src/random.c,
measured across 5 native user_settings.h variants (default, WOLFSSL_SMALL_STACK,
WOLFSSL_SMALL_STACK_CACHE, WC_RNG_SEED_CB, CUSTOM_RAND_GENERATE_BLOCK) plus a
new tests/unit-mcdc/test_random_whitebox.c white-box supplement, in the
ISO 26262 per-module MC/DC campaign.
tests/api/test_random.c / test_random.h:
- Add test_wc_RNG_HealthTest_SHA256_Ext / test_wc_RNG_HealthTest_SHA512_Ext,
exercising the previously-untested ACVP-oriented extended health-test entry
points (wc_RNG_HealthTest_SHA256_ex, wc_RNG_HealthTest_SHA512_ex/_ex2):
nonce/personalization-string/additional-input/reseed-entropy presence and
absence, in both standard and prediction-resistance modes, including
"valid pointer + zero size" calls needed to isolate each leaf's size
operand independently of its pointer operand for MC/DC.
- Add test_wc_RNG_SeedCb (WC_RNG_SEED_CB custom seed callback: success,
failing callback, and no-callback-installed paths).
- Add test_wc_RNG_CustomRandBlock (CUSTOM_RAND_GENERATE_BLOCK bypass path).
- Add test_wc_RNG_DrbgDisable (wc_Sha256Drbg_Disable/Enable/IsDisabled and
the wc_Sha512Drbg_* equivalents: drbgType selection and the "can't disable
both" BAD_STATE_E guard).
- Extend existing HealthTest bad-parameter coverage (reseed-without-seedB on
wc_RNG_HealthTest_ex / wc_RNG_HealthTest_SHA512 / wc_RNG_HealthTest_SHA512_ex,
and the untested wc_RNG_HealthTest_SHA512_ex2 3-operand bad-parameter guard).
- Guard test_wc_GenerateSeed against CUSTOM_RAND_GENERATE_BLOCK, whose
wc_GenerateSeed() ladder intentionally has no implementation in that
configuration (would otherwise be a link error, not a test failure).
tests/unit-mcdc/test_random_whitebox.c (new):
- White-box #include of random.c closing two structurally-unreachable-via-API
leaves: Hash_gen()/Hash512_gen()'s "out != NULL && outSz != 0" false side,
and array_add()'s "dLen > 0 && sLen > 0 && dLen >= sLen" false sides.
Residuals (10 of 65, documented in db/modules.json / baselines.json in the
paired testing-repo change): 4 WOLFSSL_SMALL_STACK allocation-failure
branches (no fault injection); 4 Hash_DRBG_Init/Hash512_DRBG_Init chained
Hash_df(...)==DRBG_SUCCESS conditions (transform-failure, SHA-256/512 never
fail on valid input); 2 Hash_gen()/Hash512_gen() "outSz != 0" leaves that are
structurally unsatisfiable given the caller's own outSz normalization and
loop-bound arithmetic (not merely hard to reach).
Bugs/interactions found while bringing up the CUSTOM_RAND_GENERATE_BLOCK
build variant (reported, not source-fixed): (1) random.c's PollAndReSeed()
is guarded only by "#ifdef HAVE_HASHDRBG" (not also
"!defined(CUSTOM_RAND_GENERATE_BLOCK)" like _InitRng()) and its non-callback
path unconditionally calls wc_GenerateSeed(), whose implementation ladder has
an intentionally empty CUSTOM_RAND_GENERATE_BLOCK arm -- an undefined-symbol
link error if a user_settings.h ever forces HAVE_HASHDRBG on together with
CUSTOM_RAND_GENERATE_BLOCK (this campaign's config now avoids the
combination instead of forcing it). (2) on this host, glibc's vDSO-
accelerated getrandom() does not validate the output buffer before writing
to it: wc_GenerateSeed(non-NULL os, NULL output, sz) segfaults inside
getrandom_vdso() instead of returning an error, so
TEST_WC_GENERATE_SEED_PARAMS is deliberately left undefined in the campaign
config for this test-only bad-parameter block (documented in
configs/random/user_settings.base.h).
Adds tests/api DecisionCoverage functions closing MC/DC gaps identified
by the per-module campaign (iso26262/mcdc-per-module):
dh.c: BEFORE 51/173 (29.48%) -> AFTER 107/173 (61.85%), union across
6 native variants (sp_default, sp_dh, sp_dh_nonblock,
small_stack, no_dh186, validate_keygen). New coverage: wc_DhSetKey
family bad-args and the FFDHE-table primality fast-path, named-key
helpers (SetNamedKey/GetNamedKeyParamSize/CopyNamedKey/CmpNamedKey),
wc_DhGenerateKeyPair/GeneratePublic bad-args plus a multi-group
(2048/3072/4096) generate+agree(+ct) round trip, WC_DH_NONBLOCK's
incremental state machine, wc_DhImportKeyPair/ExportKeyPair,
wc_DhCheckPubKey(_ex)/wc_DhCheckPrivKey(_ex)/wc_DhCheckKeyPair
(+ WOLFSSL_VALIDATE_DH_KEYGEN), wc_DhGenerateParams/
wc_DhExportParamsRaw, and CheckDhLN's divLen==224/256 MC/DC pair.
dsa.c: BEFORE 34/110 (30.91%) -> AFTER 51/110 (46.36%), union across
4 native variants (default, invmod_ct, fastmath, small_stack).
New coverage: wc_DsaSign_ex/wc_DsaVerify_ex digestSz bad-argument
checks and the q==1 qMinus1-iszero guard, individual single-operand
NULL-argument combinations for ImportParamsRaw/ExportParamsRaw/
ExportKeyRaw, and CheckDsaLN's case-2048 divLen==224/256 MC/DC pair.
Both modules build and pass their tests/api group + KATs across every
native variant with zero failures (10/10 variant runs).
Per-module MC/DC campaign (iso26262-mcdc-per-module). Adds decision-
coverage test cases to tests/api/test_curve25519.c and test_ed25519.c,
plus tests/unit-mcdc white-box supplements for file-static helpers
unreachable through any public wrapper (all callers pre-validate
identically before reaching them).
curve25519.c: BEFORE 26/64 (40.62%) -> AFTER 62/64 (96.88%).
Remaining 2: curve25519_smul_blind's RNG-retry loop (needs a
mockable RNG). Found and documented (not fixed - test-only
campaign) a source asymmetry bug in wc_curve25519_check_public's
BIG_ENDIAN branch (checks pub[i]!=0 where the mirrored
LITTLE_ENDIAN branch checks pub[i]!=0xff), and a build-blocking gap
in curve25519.c's WOLFSSL_CURVE25519_NOT_USE_ED25519+CURVED25519_X64
path (curve25519_base() has no header prototype anywhere in the
tree; fails under a strict C17 compiler).
ed25519.c: BEFORE 45/89 (50.56%) -> AFTER 81/89 (91.01%).
Remaining 8: 5 need a mockable hash/malloc failure to reach a
ret==0 FALSE side after a successful ed25519_hash() call; 3 are
WOLFSSL_CHECK_VER_FAULTS's redundant post-verify ConstantCompare,
a deterministic double-call on identical inputs that cannot
diverge without memory corruption in between.
Both modules build and pass across every native variant (backend
axis, blinding/non-blinding, WC_X25519_NONBLOCK, USE_INTEL_SPEEDUP,
WOLFSSL_ED25519_PERSISTENT_SHA/STREAMING_VERIFY) with zero variant
failures.
hmac.c: BEFORE 19/37 (51.35%) -> AFTER 37/37 (100%). Closed
wc_HmacSizeByType's own hash-type compound (separate physical decision
from wc_HmacSetKey_ex's copy), wc_HmacCopy's NULL guard,
wc_HmacInit_Id/wc_HmacInit_Label's length/NULL guards, wc_HmacFree's
devId/devCtx cleanup guard, and wc_HKDF_Extract_ex/wc_HKDF_Expand_ex's
NULL-inKey guard at both physical locations. No white-box needed; every
decision is reachable through the public API once WOLF_PRIVATE_KEY_ID /
WOLF_CRYPTO_CB are exercised.
cmac.c: BEFORE 19/58 (32.76%) -> AFTER 58/58 (100%). Closed independence
pairs across wc_CmacUpdate/wc_CMAC_Grow/wc_AesCmacGenerate's NULL+len
guards, wc_CmacFinalNoFree's outSz/tag-size guards, new
wc_InitCmac_Id/wc_InitCmac_Label tests plus a new
tests/unit-mcdc/test_cmac_whitebox.c supplement for _InitCmac_common's
id/label cross-combination leaves that are structurally unreachable
through the public wrappers, new DecisionCoverage tests driving
wc_AesCmacGenerate_ex/wc_AesCmacVerify_ex directly, and a WOLF_CRYPTO_CB
test reaching wc_AesCmacVerify_ex's aSz-mismatch guard (unreachable in
native software builds without a callback that violates the length
contract).
Both modules verified across all native variants (including
WOLF_PRIVATE_KEY_ID and WOLF_CRYPTO_CB axes) with zero build/test
failures.
Per-module ISO 26262 MC/DC campaign (iso26262-mcdc-per-module). Adds
DecisionCoverage-style cases to tests/api/test_chacha.c and
test_poly1305.c, plus intel-dispatch white-box supplements mirroring
the aes/sha3 technique.
chacha.c: BEFORE 6/11 (54.55%) -> AFTER 13/13 (100%). Closed
wc_Chacha_SetIV/SetKey's NULL-argument independence pairs,
wc_Chacha_Process's input/output NULL-argument pairs (both the
portable-C and USE_INTEL_CHACHA_SPEEDUP physical copies), and the
(msglen>0 && ctx->left>0) leftover-block decision's msglen==0 side.
Also adds an unaligned-key SetKey case (XSTREAM_ALIGN), a half-length
key case, and a new test_wc_Chacha_XChachaSetKey covering
wc_XChacha_SetKey. Total rose from 11 to 13 once the intelasm variant
was fixed (see campaign notes): it carries its own physical copy of
the leftover decision that the portable-only union previously missed.
poly1305.c: BEFORE 10/14 (71.43%) -> AFTER 12/14 (85.71%). Closed
wc_Poly1305Update's (m==NULL && bytes>0) inner AND, both operands.
Also adds an addSz==0 case to wc_Poly1305_MAC and a
lenToPad==WC_POLY1305_PAD_SZ case to wc_Poly1305_Pad for API
robustness. The 2 remaining conditions are structural/dead-code
residuals: wc_Poly1305SetKey's compound key==NULL check is shadowed
by an earlier unconditional key==NULL guard a few lines above (dead
code); wc_Poly1305_Pad's paddingLen<WC_POLY1305_PAD_SZ operand is
always true whenever paddingLen>0 (paddingLen is a mod-16 value
bounded to 0..15). See campaign baselines.json for full detail.
Adds test_wc_EccDecisionCoverage{,2,3,4} to tests/api/test_ecc.c (split
into four functions after a single giant one triggered a -fcoverage-mcdc
+ -O0 stack-corruption crash under this campaign's build, reproduced and
root-caused with gdb: a plain on-stack mp_int's used/size fields were
already garbage immediately after its own mp_init()) and a new
tests/unit-mcdc/test_ecc_whitebox.c white-box supplement, closing curve
lookup, point-is-at-infinity, gen_k, init_id/init_label, sign/verify
length, point DER import/export, is_point, export_public_raw/private_raw,
rs_raw_to_sig, ctx_set_kdf_salt, set_custom_curve, X963_KDF, curve_load,
_ecc_import_private_key_ex, and ecEncCtx protocol-guard decisions.
ecc.c union MC/DC across all 6 campaign variants: 217/597 -> 287/597.
tests/api/test_wolfmath.c gains six DecisionCoverage test functions
covering sp_int.c's mp_*/sp_* API: the allocation family (sp_init_size,
sp_grow, sp_copy, sp_exch), the shift family (sp_set_bit, sp_2expt,
sp_lshd, sp_rshb), the single-digit and multi-precision arithmetic
families (sp_add_d/sp_sub_d/sp_mul_d/sp_div_d/sp_mod_d/sp_div_2/
sp_div_2_mod_ct/sp_add/sp_sub/sp_addmod_ct/sp_submod_ct/sp_div,
including their WOLFSSL_SP_INT_NEGATIVE sign-path counterparts), the
conversion family (sp_div_2d/sp_mod_2d/sp_mul_2d/sp_sqrmod/
sp_mont_red_ex/sp_to_unsigned_bin_len(_ct)/sp_tohex/sp_read_radix), and
the sp_invmod/sp_exptmod_ex/sp_gcd/sp_prime_is_prime(_ex) top-level
argument and degenerate-input checks. Each exercises an internal
size/capacity guard or argument check via a deliberately undersized
destination (sp_init_size with a small size) or an out-of-range
argument - legitimate, public ways to reach decisions valid-sized RSA/
ECC/DH usage never trips.
tests/unit-mcdc/test_sp_int_whitebox.c is a new white-box supplement
(compiles sp_int.c in directly) closing the sp_count_bits/sp_cnt_lsb
non-normalized-digit trim loops: no public caller can produce that
state since every public mutator normalizes via sp_clamp before
returning.
Part of the ISO 26262 per-module MC/DC campaign's sp-math module
(wolfcrypt/src/sp_int.c, Phase 1): 412/547 (75.32%) MC/DC across 6
build-variant axes (WOLFSSL_SP_MATH_ALL vs bare WOLFSSL_SP_MATH,
WOLFSSL_SP_SMALL, WOLFSSL_SP_INT_NEGATIVE, WOLFSSL_SP_DIV_WORD_HALF,
WOLFSSL_SMALL_STACK) + the white-box, up from a 318/547 baseline. The
remaining gaps are deep invmod/exptmod/prime/gcd internal state-machine
internals, the SP-accelerated-backend-entangled RSA/DH key-size
dispatch, and other structural residuals; campaign-side files (config,
module registry, baseline) live in the separate testing repo.
Extend test_wc_RsaDecisionCoverage / test_wc_RsaFeatureCoverage and add a
tests/unit-mcdc white-box supplement (test_rsa_whitebox.c) for the per-module
MC/DC campaign, raising rsa.c union MC/DC from 67/268 to 156/283.
DecisionCoverage/FeatureCoverage additions (API-reachable argument and feature
paths): wc_RsaFunction 7-way arg check, wc_RsaDirect, wc_InitRsaKey_Id/Label,
wc_MakeRsaKey size check, wc_CheckProbablePrime, wc_RsaPSS_CheckPadding, OAEP
label mismatch (encrypt + decrypt), and a WC_RSA_NO_PADDING raw round trip.
A PSS-SHA512-on-1024-bit-key case is staged behind if(TEST_RSA_BITS==1024).
White-box supplement (file-static helpers shielded by a public pre-guard, so
their argument checks are unreachable from the API): _NewRsaKey_common,
_RsaExportKey, _RsaFlattenPublicKey, wc_CompareDiffPQ, _RsaPrivateKeyDecodeRaw,
RsaPad, RsaUnPad, _CheckProbablePrime. Both halves of each independence pair
are exercised within the white-box binary. Modeled on test_aes_whitebox.c;
main() always returns 0 so a setup failure is a skip, not a discarded variant.
Selftest/FIPS-sensitive assertions stay inside the existing
!defined(HAVE_SELFTEST) guard and the OAEP cases stay under !defined(HAVE_FIPS),
matching the committed idiom for this frozen-boundary file.
test_wc_AesEaxArgMcdc exercised the eax/out/in operands of
wc_AesEaxEncryptUpdate / wc_AesEaxDecryptUpdate but always passed
(authIn=NULL, authInSz=0), so the guard's authInSz>0 && authIn==NULL
term was never evaluated with authInSz>0 -- leaving those two
conditions (and their decrypt twins) uncovered in the MC/DC union.
Add, for both Update functions, the (authIn==NULL, authInSz>0) row
(rejected with BAD_FUNC_ARG) and the (authIn!=NULL, authInSz>0) row
(accepted), completing both conditions' independence pairs.
These four conditions were the only uncovered code the recent
master merge (AES-GCM-SIV, AES-OFB/CFB callbacks) added to aes.c that
was reachable from tests/api; closes them so the aes.c union returns
to its residual-only gap (410/445, gap 35).
fixes longstanding bug in afalg_aes.c that made no-AAD handles non-interchangeable with AAD handles. also adds missing arg validation and KEYUSAGE_E checks throughout AF_ALG.
test_wc_falcon_sign_verify aborted (SIGABRT) when run as part of the
full unit suite in liboqs configs. The direct OQS_SIG_keypair() call
draws from liboqs' randombytes callback, which wolfSSL points at its
default liboqs RNG; wolfSSL_liboqsClose() (run by wolfCrypt_Cleanup)
frees that RNG without resetting liboqs_init, so after any earlier
Init/Cleanup cycle in the suite the re-Init never re-creates it and
the callback abort()s on the freed RNG. Running the test alone passed,
which is why this only surfaced in make check.
Drop the direct liboqs usage entirely: decode the embedded
bench_falcon_level1_key (certs_test.h) with wc_Falcon_PrivateKeyDecode
and exercise sign/verify through the wolfSSL API only, which hands the
test's own RNG to liboqs and does not depend on the default-RNG
lifecycle. Also removes the oqs/oqs.h include and the OQS_STATUS
handling; with no liboqs symbols left in the body, only the guard
still references HAVE_LIBOQS, easing the planned liboqs removal.
Validated in --with-liboqs --enable-experimental --enable-falcon (the
failing PRB-liboqs config): the full unit suite now completes with the
test passing at the position that aborted; also passes under
opensslall+falcon and compiles clean with -Werror=bad-function-cast.
ExpectIntEQ casts both arguments to int (tests/unit.h ExpectInt), and
casting a function call that returns the liboqs OQS_STATUS enum trips
-Werror=bad-function-cast, which is part of the test warning set. Store
the status in a local first; casting a variable does not trigger the
warning. Broke falcon-enabled configs once the HAVE_PQC guard fix made
this test compile.
Verified: the TU reproduces the exact CI error before this change and
compiles clean after, and test_wc_falcon_sign_verify still passes in a
--disable-md5 --enable-opensslextra --enable-falcon --with-liboqs
build.
Address the PR 10845 review findings:
* test_signature.c: the Falcon sign/verify test was guarded on
HAVE_PQC, which no build system ever defines (--enable-falcon sets
HAVE_FALCON only), so the test always compiled out to skipped. Gate
it on HAVE_FALCON && HAVE_LIBOQS like the library does, and drop the
now-unreferenced HAVE_PQC entry from .wolfssl_known_macro_extras.
Verified with --enable-opensslall --enable-experimental
--enable-falcon --with-liboqs: the test now executes and passes.
* api.c: revert the (OPENSSL_EXTRA || OPENSSL_ALL) widening of the
inner guards of test_wolfSSL_TXT_DB and the new
test_wolfSSL_NCONF_negative_paths. Both functions live inside the
enclosing OPENSSL_ALL block and their TEST_DECLs are OPENSSL_ALL-
gated (and TXT_DB/NCONF themselves are OPENSSL_ALL-only APIs), so
the widening could never take effect. Inner guards now match their
siblings (filesystem/BIO deps only).
* test_pkcs12.c: wrap the expected BAD_FUNC_ARG values of the new
parse guardrail asserts in WC_NO_ERR_TRACE() for consistency with
the rest of the PR's negative-path assertions.
All six affected tests pass in an opensslall+falcon+liboqs build:
falcon_sign_verify, TXT_DB, NCONF, NCONF_negative_paths,
PKCS12_parse_guardrails, PKCS12_create_guardrails.
PRB-generic-config-parser failed in test_wolfSSL_X509V3_EXT under an
OPENSSL_EXTRA (non-OPENSSL_ALL) config:
test_ossl_x509_ext.c:1519 ExpectIntEQ(actual, 0) /* got -5 */
The function walks the OCSP root CA's extensions by hardcoded index (i=0 basic
constraints, i=1 subject key id, i=2 authority key id, ...) and asserts fixed
values. The strcmp result -5 is exactly '2'-'7': the i=1 i2s produced the
authority-key-id value ("27:8E:...") instead of the subject-key-id
("73:B0:..."), i.e. the stored-extension order differs in OPENSSL_EXTRA-only
builds, so the index assumption breaks.
On master this test is gated on OPENSSL_ALL; the MC/DC campaign commit
(bc92090b3) over-widened it to (OPENSSL_EXTRA || OPENSSL_ALL) when splitting
api.c. Revert just this function's guard to OPENSSL_ALL. The by-NID
test_wolfSSL_X509V3_EXT_aia above keeps its OPENSSL_EXTRA widening (that is the
one the AIA leak fix needed, and it looks extensions up by NID so it is
order-independent).
Verified: skipped under --enable-opensslextra (no longer runs/fails there),
runs and passes under --enable-all.
test_wc_RsaDecisionCoverage decrypted an OAEP-SHA256 cipher text as PKCS#1 v1.5
and asserted it must return < 0. That is flaky: v1.5 decrypt-unpadding of the
random OAEP plaintext spuriously "succeeds" whenever byte[1] lands on 0x02 with
a valid 0x00 separator after >=8 nonzero bytes -- a few-percent-per-run coin
flip, and a fresh random key is generated each run. It surfaced as intermittent
make-check failures (e.g. "result: 36 >= 0", "140 >= 0") on PR CI.
Replace it with a deterministic padding-mismatch: decrypt the (no-label) OAEP
cipher text as OAEP with a non-empty label. OAEP authenticates the label via
lHash, so a label mismatch fails the integrity check every time, still
exercising the padding-mismatch decision branch in rsa.c.
Verified locally by looping test_wc_RsaDecisionCoverage 150x in an
OAEP+SHA256 build: old assertion failed 2/150, new assertion 0/150.
PRB-fips-repo-and-harness-test-v3-part1 (FIPS v2, --enable-fips=v2
--enable-opensslextra/--enable-opensslall) failed in test_wc_AesFeatureCoverage.
Reproduced against a real FIPS v2 build (linuxv2 = WCv4-stable module, in-core
integrity hash regenerated)
The PRB-CAVP-selftest-v2 leg (--enable-selftest=v2, frozen wolfCrypt 4.1.0
crypto) failed in test_wc_AesFeatureCoverage.
Reproduced against that exact build; the failing assertion is:
tests/api/test_aes.c:8324
ExpectIntEQ(wc_AesCcmEncrypt(&aes, NULL, NULL, 0, ccmNonce13,
sizeof(ccmNonce13), ccmTag, 16, ccmAad, sizeof(ccmAad)), 0) /* got -173 */
That is the AAD-only (empty-plaintext) CCM case. Current wolfCrypt accepts
NULL in/out when inSz==0; the frozen v4.1.0 wc_AesCcmEncrypt rejects in/out==NULL
unconditionally and returns BAD_FUNC_ARG. Same class as the RsaDecisionCoverage
self-test fix: the frozen module's argument-validation contract predates the
modern behaviour this test asserts.
This function's value is MC/DC of the open wolfcrypt/src/aes.c feature paths,
which is not the aes.c compiled under --enable-selftest, so under self-test it
measures nothing and only risks such divergences. The key-wrap block in this
same function already excludes HAVE_SELFTEST (and the AES *ArgMcdc tests do
too); extend that to the GCM/GMAC and CCM blocks. HAVE_FIPS is intentionally
left running -- that (newer) module honours these paths and never flagged this
test; the open MC/DC campaign builds are unaffected.
Verified: skipped cleanly under --enable-selftest=v2 (test index 278, matching
CI); open build still runs and passes it.
The PRB-CAVP-selftest-v2 leg (./configure --enable-selftest=v2, which overlays
frozen wolfCrypt 4.1.0 crypto) failed in test_wc_RsaDecisionCoverage.
Reproduced against that exact build; the failing assertion is:
tests/api/test_rsa.c:1474
ExpectIntEQ(wc_RsaSetRNG(&key, NULL), BAD_FUNC_ARG) /* got 0 */
So the assertion is correct for current wolfCrypt but not part of the frozen
self-test module's contract. This test's whole purpose is MC/DC of the *open*
wolfcrypt/src/rsa.c decision branches, which is not even the rsa.c compiled
under --enable-selftest, so under self-test it measures nothing and only risks
divergent error codes like this one. The sibling key-gen/decision tests in this
file (test_wc_CheckProbablePrime, the RsaKeyGeneration group) exclude
HAVE_SELFTEST for the same reason; do so here too.
Guard the whole function rather than the single assertion: none of it counts
toward the (open-build) MC/DC campaign under self-test, and a whole-function
guard is robust against any other frozen-vs-current divergence in the same
body. HAVE_FIPS is intentionally left running -- that (newer) module honours
these decisions (and excludes the WC_RSA_BLINDING wc_RsaSetRNG block anyway),
and the open MC/DC campaign builds are unaffected.
Verified: with the guard, the test is cleanly skipped under --enable-selftest=v2
(test index 365, matching CI); the open build still runs and passes it.
A second apple-M1 FIPS segfault (--enable-fips=v5): test_wc_AesCcmArgMcdc probes
the pure-C CCM inSz-overflow decision by calling wc_AesCcmEncrypt/Decrypt with a
1-byte dummy in/out buffer and a claimed length of 65536, relying on the pure-C
path returning AES_CCM_OVERFLOW_E *before* touching the buffer. The FIPS module's
CCM does not reject early, so it writes 65536 bytes into the 1-byte buffer and
segfaults. (The rounds=0 corruption in the same test was already skipped via
WC_TEST_AES_ROUNDS_OFFLOADED, but the two overflow blocks were not.)
Every decision this test targets lives in pure-C aes.c CCM code that is not
compiled in FIPS/self-test builds, so guard the whole function on
!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) rather than patching each unsafe
block. The other *ArgMcdc tests only corrupt rounds (macro-skipped) and have no
oversized-buffer calls, so they need no further change.
Verified: --enable-all still builds and test_wc_AesCcmArgMcdc passes; the 65536
overflow calls are present non-FIPS and absent when HAVE_FIPS is defined.
The CAVP self-test build (--enable-selftest) failed to compile test_aes.c:
wc_AesGcmSetExtIV (test_wc_AesGcmDecisionCoverage) and wc_Gmac/wc_GmacVerify
(test_wc_AesGmacArgMcdc) are declared only under !WC_NO_RNG in mainline and are
absent from the frozen self-test module's headers (they are present under FIPS -
the apple-M1 FIPS build compiled and passed both), so -Werror=implicit-function-
declaration aborted the build.
Gate those specific calls (and the now-otherwise-unused iv buffer) on
!defined(WC_NO_RNG) && !defined(HAVE_SELFTEST). wc_GmacSetKey stays available, so
its coverage is retained under self-test. FIPS builds are unaffected.
Verified: --enable-all still builds and both tests pass; preprocessing test_aes.c
with -DHAVE_SELFTEST leaves no wc_AesGcmSetExtIV/wc_Gmac/wc_GmacVerify calls in
any always-compiled function (remaining ones are in the WOLFSSL_AESGCM_STREAM
stream test, which the self-test config disables).
test_wc_AesCcmArgMcdc segfaulted on the FIPS builds (apple-M1 config A, CAVP
self-test), exit 139. The AES *ArgMcdc tests reach the post-key-setup "ret != 0"
checkpoints by corrupting aes->rounds = 0 and calling wc_AesCcmEncrypt/Decrypt.
That relies on the pure-C AesEncryptBlocks_C guard (if r==0 return KEYUSAGE_E) to
turn the corruption into a clean error return. Under the FIPS / self-test module
the AES implementation has no such guard, so rounds=0 runs AES with a zero-round
key schedule and dereferences past the key schedule -> SIGSEGV.
The corruption is already gated by WC_TEST_AES_ROUNDS_OFFLOADED (crypto-cb / asm
offload). FIPS and self-test are the same situation - the pure-C guard is not in
the compiled path - so add HAVE_FIPS / HAVE_SELFTEST to that macro. The three
function-level FIPS-guarded tests (SetKey/Modes/Cmac ArgMcdc) were already
skipped; test_wc_AesCcmArgMcdc is not, and its non-corruption CCM coverage now
still runs under FIPS while only the rounds-corruption blocks are skipped.
Verified: --enable-all (non-FIPS) still runs and passes all rounds-corruption
tests; the corruption blocks compile out only under FIPS/self-test.
This branch widened test_wolfSSL_X509V3_EXT's guard from OPENSSL_ALL to
(OPENSSL_EXTRA || OPENSSL_ALL). The Authority Info Access sub-test frees its
aia stack with wolfSSL_sk_ACCESS_DESCRIPTION_pop_free(aia, NULL), relying on the
stack's type-based element free - but wolfssl_sk_get_free_func() only wires up
wolfSSL_ACCESS_DESCRIPTION_free for STACK_TYPE_ACCESS_DESCRIPTION under
OPENSSL_ALL. In an OPENSSL_EXTRA-only build (now reachable) the NULL callback
frees the stack nodes but leaks each ACCESS_DESCRIPTION (struct + method OBJ +
location GENERAL_NAME + URI string): 370 bytes, caught by ASAN/valgrind.
Pass wolfSSL_ACCESS_DESCRIPTION_free explicitly (available under OPENSSL_EXTRA);
correct under OPENSSL_ALL too. Verified leak-free under ASAN with the failing
config (--enable-opensslextra --enable-crl ... --disable-fastmath).
clang-tidy (all-c89, async-quic, intelasm) flagged `ccmTag[0] ^= 0x01` as a use
of an uninitialized value: the analyzer does not model wc_AesCcmEncrypt writing
the tag buffer. Zero-initialize ccmTag; the subsequent encrypt still overwrites
it before the tamper, so behavior is unchanged.
Sean Parkinson
JacobBarthelmehandGitHub
Daniele Lacamera
Daniel Pouzzner
David GarskeandGitHub
Reda Chouk