* add missing null key checks to wc_ed25519_verify_msg_init(), wc_ed25519_verify_msg_update(), and wc_ed25519_verify_msg_final().
* add WC_ARG_NOT_NULL() attributes to args of static functions as appropriate.
* add FIPS >v6 gates to new null key tests and a new invalid hash size test in test_wc_ed25519_sign_verify_ctx_ph() and test_wc_ed25519_verify_streaming().
wolfssl/wolfcrypt/aes.h: if HAVE_FIPS && !WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED, make wc_AesGcmEncrypt() a WOLFSSL_LOCAL, and if !_WC_BUILDING_AES_C, add a WC_DEPRECATED() attribute to it.
wolfssl/wolfcrypt/wc_compat.h, wolfssl/wolfcrypt/include.am, .wolfssl_known_macro_extras: add wc_compat.h: when HAVE_FIPS and !WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED, shim wc_AesGcmEncrypt() to remap it to FIPS-allowed APIs.
wolfssl/wolfcrypt/types.h: at the end, #ifndef BUILDING_WOLFSSL, #include <wolfssl/wolfcrypt/wc_compat.h>, to assure transparent shimming of wc_AesGcmEncrypt() for all outside callers.
wolfcrypt/src/evp.c, wolfcrypt/src/hpke.c, wolfcrypt/src/pkcs7.c, wolfcrypt/benchmark/benchmark.c, wolfcrypt/test/test.c, wolfssl/ssl.h: #include <wolfssl/wolfcrypt/wc_compat.h> to shim in-library/in-module calls to wc_AesGcmEncrypt().
src/internal.c: in TicketEncDec(), add const attributes to constable input args, and fix swapped out/in in calls to wc_AesGcmEncrypt().
tests/api/test_aes.c: in test_wc_AesGcmEncryptDecrypt(), skip longIV test if WC_TEST_AES_GCM_ENCRYPT_NO_NONSTD_IV (defined by wc_compat.h when needed).
wolfssl/wolfcrypt/error-crypt.h, wolfssl/error-ssl.h, wolfcrypt/src/error.c, src/internal.c:
* add FIPS_WRONG_API_E;
* put several error codes back into sequence in wc_GetErrorString() switch().
* move wc_static_assert()s from headers to corresponding .c files, to eliminate dependency on wolfcrypt/types.h;
* remove unneeded #include <wolfssl/wolfcrypt/types.h> from error-crypt.h.
WOLFSSL_OCSP_CHECKALL is a scope flag ("always leaf, but all ?"), selecting
which certs are checked, not how hard to fail when one advertises no OCSP
responder in its AIA. Treating a missing responder as a hard failure breaks
any chain whose CA publishes no OCSP URI (e.g. Google GTS WR2), a
configuration that only grows as CAs drop responders. Strictness belongs in
its own opt-in flag.
- Keep CHECKALL scope-only; a cert with no responder soft-fails by default.
- Return distinct OCSP_NO_URL for "no responder", separate from a failed
lookup; stapling response handling stays best-effort (mapped to CERT_GOOD).
- Add WOLFSSL_OCSP_FAIL_IF_NOT_SUPPORTED (via OcspNoUrlPolicy) to refuse such
certs; independent of CHECKALL.
- Add test_ocsp_no_url_policy covering both halves.
Added support for encoding and decoding keys in ASN.1.
Added support for X.509 certificates and CSRs.
Generated certificates and CSRs. Not fo FrodoKEM-640 as is not in the specs.
check-source-text (rule I) flags error-code identifiers used as comparison
operands even inside comments. Reword three comments so the code name is no
longer written as "(ret == PUBLIC_KEY_E)" / "(ret != CRYPTOCB_UNAVAILABLE)"
(test_kdf.c, test_ed448.c); the bare token on its own is fine.
clang-tidy reported a possible 0-byte malloc in test_mlkem.c: the ML-KEM
key/ciphertext sizes come from wc_MlKemKey_*Size() queries, which the analyzer
cannot prove nonzero. Guard each XMALLOC with a >0 check so the allocation
size is provably positive; the ExpectNotNull() checks still catch a 0-size
query at runtime.
The FIPS build diverges from the OPEN build on KDF behavior these exhaustive
MC/DC probes assert: wc_HmacSetKey enforces the 14-byte HMAC_FIPS_MIN_KEY, so
wc_Tls13_HKDF_Extract with the short salt/ikm here returns HMAC_MIN_KEYLEN_E
(-200) instead of 0 (test_kdf.c:766), and wc_PRF with resLen==0 returns 0
instead of BAD_FUNC_ARG (test_kdf.c:118). kdf.c coverage is measured only in
non-FIPS campaign variants, so guard both test_wc_KdfDecisionCoverage and
test_wc_KdfFeatureCoverage bodies with !HAVE_FIPS && !HAVE_SELFTEST; they run
in full in OPEN builds and skip cleanly under FIPS/selftest. Verified against
a --enable-fips=v5 build (both now skip, 0 failures).
kdf: wc_Tls13_HKDF_Extract_ex / wc_Tls13_HKDF_Expand_Label_ex postdate the
frozen FIPS/selftest kdf.h and are undeclared there. Gate every _ex call site
behind WOLFSSL_TEST_HKDF_EX (!HAVE_FIPS && !HAVE_SELFTEST); the thin non-_ex
wrappers, which exist everywhere, keep their coverage.
wolfmath: test_wc_TfmDecisionCoverage / test_wc_TfmExptModDecisionCoverage /
test_wc_IntegerDecisionCoverage called library-internal fp_* and s_mp_*
functions that carry no MP_API decoration, so under -fvisibility=hidden they
are not exported from the shared library and unit.test failed to link them
(undefined reference to fp_set / s_mp_mul_digs / ...) in the default shared CI
build. Relocate those decision drivers into the tests/unit-mcdc white-boxes,
which reach the internals legally by #including tfm.c / integer.c; tests/api
now uses only the public mp_* interface. mp_rand_prime calls are gated by
WOLFSSL_KEY_GEN (and, for integer, !NO_DH || !NO_DSA) to match where the
library declares and defines it.
Under DEBUG_WOLFSSL, wc_HashUpdate/Final/Free first check (hash->type != type)
and return BAD_FUNC_ARG before the switch, so the "unsupported type ->
HASH_TYPE_E" arm is unreachable on an uninitialized hash (wc_HashInit refuses
those types). Guard those Update/Final/Free assertions with #ifndef
DEBUG_WOLFSSL; the arm's coverage comes from non-DEBUG variants in the union.
Fixes the cmake (old-TLS/debug) build failure. wc_HashInit assertions keep
running (Init has no such type check).
This bug is fixed in PR #10927
Close API-reachable and file-static MC/DC gaps identified by the per-module
GAPS.md reports (+291 conditions across the union):
tfm.c 71->89, integer.c 49->92, ed448.c 62->92 (91%), wc_slhdsa.c 99->155
(88%), wc_mldsa.c 169->252, wc_mlkem.c 46->65 (96%), wc_lms_impl.c 60->82,
wc_xmss_impl.c 38->57.
Enriched DecisionCoverage in test_wolfmath.c (tfm/integer), test_ed448.c,
test_slhdsa.c; new arg/state/length cases in test_mldsa.c/test_mlkem.c; and
per-source *_gap white-box supplements under tests/unit-mcdc/ driving the
static internals (WOTS/FORS/NTT/poly/Merkle/comba/Montgomery, etc.). Remaining
uncovered conditions are justified residuals (AVX2/cpuid dispatch on an
always-AVX2 host, deep alloc/crypto-failure err-chains, asm-only paths).
Copilot review (test_random.c:1238): test_wc_DrbgFeatureCoverage claimed a
bounded burst of generate calls crosses WC_RESEED_INTERVAL, but the default
interval is 1,000,000 so 40 generates never reach it and the
DRBG_NEED_RESEED -> PollAndReSeed branch was not exercised in normal builds.
Force the path instead: probe one generate to confirm the Hash_DRBG path is
active (skipped under e.g. --enable-intelrand), then set the active DRBG's
reseedCtr to WC_RESEED_INTERVAL - 1 and generate across it, asserting the
reseed resets the counter (same idiom as test_wc_RNG_ReseedBoundary), for
both SHA-256 and SHA-512 DRBG widths. Comment corrected to match.
- CMakeLists.txt: register the new tests/api sources (test_kdf.c,
test_coding.c, test_error.c, test_wolfentropy.c) with the unit_test
target; fixes cmake link failure (undefined
test_wc_GetErrorStringDecisionCoverage/test_wc_ErrorStringDecisionCoverage).
- tests/api/test_mldsa.c: guard the wc_MlDsaKey_MakeKey NULL-arg checks
in test_wc_MldsaDecisionCoverage with WOLFSSL_MLDSA_NO_MAKE_KEY; fixes
link failure in verify-only builds (tinytls13-psk-mldsa,
all-pq-verify-only-noasm).
- tests/unit-mcdc/*: reword 'statics' to 'static helpers' in comments to
satisfy codespell.
The LMS and XMSS X.509 generation tests persist their stateful private
keys through read/write callbacks to hardcoded /tmp paths
(/tmp/wolfssl_test_lms.key, /tmp/wolfssl_test_xmss_gen.key). When
make check runs multiple configs in parallel on a shared /tmp (CI
shards), concurrent unit.test processes clobber the same file; a
subsequent read then gets a different-sized key and signing fails with
IO_FAILED_E (e.g. test_rfc9802_xmss_x509_gen returning -291).
Give the LMS and XMSS test key-file paths a per-process name via
getpid(), guarded by HAVE_GETPID/WOLFSSL_NO_GETPID with <unistd.h>
included under the same guard and a plain-path fallback, so the file
still compiles on Windows / NO_WOLFSSL_DIR / no-OS builds. Verified by
racing six concurrent unit.test processes: 5/6 failed before, 6/6 pass
after; the HAVE_GETPID and fallback paths both compile clean under
-Werror.
```
==485951== Uninitialised value was created by a stack allocation
==485951== at 0x207D47: des3_key_wrap_test (test.c:12773)
```
and
```
==485951== Uninitialised value was created by a stack allocation
==485951== at 0x3A075E: test_wc_AesGcmArgMcdc (test_aes.c:8968)
```
test_pkcs7.c: test_wc_PKCS7_BER also accepts ret >= 0 (Bleichenbacher mitigation hides the RSA key error, making the result non-deterministic).
suites.c: skip --send-ticket cases as NOT_BUILT_IN when HAVE_SESSION_TICKET
is off (avoids port-11111 race).
wc_RsaFunction is declared WOLFSSL_API but the FIPS module does not export
it, so test_wc_RsaDecisionCoverage's 7-condition wc_RsaFunction arg-check
block fails to link (undefined reference) across the FIPS legs. Exclude the
block under HAVE_FIPS; cipher/plain/key/rng stay used by the other checks,
so no unused-variable. Not frozen under self-test, so it stays there.
The frozen FIPS/self-test hmac's wc_HmacSizeByType returns HMAC_KAT_FIPS_E
(-206) for any type it doesn't accept - not just the invalid 9999 case but
also MD5 (not a FIPS HMAC type), which returned -206 instead of the digest
size. Rather than chase each type, exclude the whole function under
HAVE_SELFTEST/HAVE_FIPS (the campaign measures MC/DC on open builds only).
- test_cmac.c: wc_AesCmacGenerate_ex / wc_AesCmacVerify_ex are absent from
the frozen FIPS cmac.h (fips-check freezes cmac.h at WCv4-stable /
WCv5.0-RC12 / v5.2.1-stable, none of which declare the _ex variants), so
the DecisionCoverage + cryptocb tests calling them fail to compile on the
FIPS legs. Add !defined(HAVE_FIPS) to their guards. cmac is NOT frozen
under CAVP self-test, so no HAVE_SELFTEST clause is needed.
- test_random.c: the WC_RNG_SEED_CB callbacks (test_random_seedCb_ok/_fail)
were guarded #ifdef WC_RNG_SEED_CB, but their only caller test_wc_RNG_SeedCb
is additionally !HAVE_SELFTEST && !HAVE_FIPS; a fips-ready build with
WC_RNG_SEED_CB on compiled the statics but not the caller ->
-Werror=unused-function. Match the statics' guard to the caller's.
- test_dh.c: zero-initialize priv/pub in test_wc_DhCheckKeyPair. clang-tidy
flags pub[pubSz-1] ^= 0x01 as a read of an uninitialized variable (it
cannot see that wc_DhGenerateKeyPair fills pub at runtime), failing
all-c89-clang-tidy / clang-tidy-all-intelasm / clang-tidy-all-async-quic.
- test_curve25519_whitebox.c: wrap the BAD_FUNC_ARG operands in
WC_NO_ERR_TRACE() (check-source-text unescaped-error-code check).
- test_sha3_whitebox.c: drop the bogus WOLFSSL_NO_SHA3 guard (no such
macro; the real gate is WOLFSSL_SHA3), which check-source-text reported
as an unknown macro.
test_wc_SpIntExptGcdDecisionCoverage sized r with sp_init_size(&r, 2)
expecting sp_gcd(2^140, 2^70, &r) == 0, on the assumption that 2^70
occupies 2 digits. That only holds for 64-bit SP_WORD_SIZE; on a 32-bit
build (e.g. --enable-sp-math-all with ALT_ECC_SIZE under -m32) 2^70 spans
3 digits, so r->size(2) < b->used(3) trips sp_gcd's dest-size check and it
returns MP_VAL. Size r to b.used so the "r->size < b->used" operand stays
false (the intended MC/DC pair) for any word size.
test_wc_CmacFinal declares tooSmallMacSz but only uses it inside the
"#if (!HAVE_FIPS || FIPS>=5.3) && !HAVE_SELFTEST" block (wc_CmacFinalNoFree
bad-arg checks). Under the CAVP-selftest config that block is compiled out,
leaving the variable unused -> -Werror=unused-variable. Declare it under the
same condition as its use.
The CAVP-selftest-v2 CI leg configures with --enable-dsa --enable-keygen
(richer than the minimal selftest profile), so it compiles two more
functions that call wolfCrypt APIs absent from the frozen v4.1.0 module:
- test_wc_DsaSign_bad_digestSz -> wc_DsaSign_ex / wc_DsaVerify_ex
- test_wc_DhGenerateParams_and_ExportRaw -> wc_DhGenerateParams /
wc_DhExportParamsRaw
Exclude both from HAVE_SELFTEST / HAVE_FIPS builds. Only a frozen build
run under the CAVP config (DSA + keygen on) exposes these.
test_wc_EccDecisionCoverage3 calls wc_ecc_import_unsigned and
wc_ecc_rs_raw_to_sig, which are not available in the frozen
CAVP-selftest wolfCrypt module (their declarations are gated off by the
minimal selftest feature config), so the CAVP-selftest CI leg fails to
compile them under -Werror. Exclude the function from HAVE_SELFTEST /
HAVE_FIPS builds, matching the sibling EccDecisionCoverage functions.
This class is only visible via an actual --enable-selftest compile, not
a header symbol diff.
The FIPS and CAVP-selftest CI legs overlay an ancient frozen wolfCrypt
per module (selftest ~= wc 4.1.0; FIPS v2 = WCv4-stable, older still).
New MC/DC tests call post-freeze wc_* APIs absent from those modules,
which fails to compile under -Werror on those legs. The campaign only
measures MC/DC on open per-module builds, never on FIPS/selftest, so
these functions gain no coverage there and only risk breaking CI.
Guard every affected test function with
!defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) so it compiles out in
frozen builds, determined by diffing each header against both
v4.1.0-stable (selftest) and WCv4-stable (oldest FIPS v2):
- test_dh.c: SetNamedKey/CheckPubKey/CheckPrivKey/CheckKeyPair/
GenerateKeyPair* /Agree/ImportExport/SetKey (named-key, FFDHE,
DhAgree_ct, DhGeneratePublic, DhSetCheckKey - the last v2-only)
- test_ecc.c: mulmod + EccDecisionCoverage/2/4 (key_get_priv,
import_point_der_ex, gen_k, init_label, ctx_set_kdf_salt, ...)
- test_dsa.c: DsaKeyToPublicDer (add FIPS clause to existing selftest guard)
- test_hmac.c: HmacInit_Label, HmacInit_Id (wc_HmacInit_Id v2-only)
- test_random.c: RNG_SeedCb (wc_SetSeed_Cb)
- test_rsa.c: RsaFeatureCoverage (wc_InitRsaKey_Label)
- test_sha512.c: sha512 cryptocb fallback / default-devid variants
test_aes.c already handles this via per-feature guards (PR #10845).
Open build stays warning-clean and all guarded tests still run there.
Two MC/DC tests asserted pre-fix behavior; the corresponding library
fixes changed the observable result:
- test_wc_DsaImportParamsRaw_individual_args: the untrusted-import
primality rejection now surfaces DH_CHECK_PUB_E, since CheckDsaLN is
gated on err==MP_OKAY (commit 30ceba03c) and no longer overwrites it
with BAD_FUNC_ARG.
- test_wc_curve25519_check_public_be: the big-endian "order or higher"
loop now compares pub[i] != 0xff (symmetric with the little-endian
branch, commit 600880a0a), so the rejection input needs pub[1..30]
== 0xff, not 0x00.
Updated the assertions and the now-stale explanatory comments. Both
groups pass under --enable-all --enable-intelasm; full make check green.
The mem-zero false-positive these calls tripped is fixed at the library
level in wc_MakeRsaKey() on the sibling branch (fixes-2026-07-10 / PR
10875), which zero-initializes its stack temporaries so the early-out
mp_memzero_check() is safe. Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the
RsaSizeCheck decision is exercised in the instrumented build too. Depends
on PR 10875 for the all-check-mem-zero config.
The mem-zero registration leak this guard worked around is fixed at the
library level in wc_FreeDhKey() on the sibling branch (fixes-2026-07-10 /
PR 10875). Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the import/export test
runs and validates that fix. This test therefore depends on PR 10875 to
pass the all-check-mem-zero CI config.
test_wc_DhGenerateParams_and_ExportRaw asserted wc_DhGenerateParams()==0,
but the bare WOLFSSL_SP_MATH backend cannot generate DH domain parameters
(returns PRIME_GEN_E), so the all-pq-sp-math CI config (--enable-sp-math)
failed the assertion. Guard the test on !defined(WOLFSSL_SP_MATH); the
generate/export decisions are covered with WOLFSSL_SP_MATH_ALL, fastmath
and heapmath. Verified: --enable-sp-math unit.test passes (test skipped);
the test still runs under --enable-all.
The all-check-mem-zero CI config (--enable-all -DWOLFSSL_CHECK_MEM_ZERO)
aborted unit.test (exit 134) in two of the new decision-coverage tests.
Both stem from wolfSSL mem-zero-tracking gaps that these tests are the
first to exercise; the underlying decisions are covered in every normal
build, so guard the specific triggers out of the instrumented build:
- test_rsa.c (test_wc_RsaDecisionCoverage): calling wc_MakeRsaKey() with an
out-of-range size makes it 'goto out' and run mp_memzero_check() over its
not-yet-initialized local temporaries, which over-scans the stack and
false-positives on the still-registered, legitimately non-zero key->d of
the key made earlier in the test. Skip the two bad-size calls under the
instrumented build.
- test_dh.c (test_wc_DhImportExportKeyPair): wc_DhImportKeyPair() registers
key->priv via mp_memzero_add(), but wc_FreeDhKey() clears it with
mp_forcezero() (which does not deregister) and has no wc_MemZero_Check()
like wc_FreeRsaKey() does, so the registration leaks into later tests.
Skip this import/export test under the instrumented build.
Verified: --enable-all -DWOLFSSL_CHECK_MEM_ZERO builds and unit.test passes
(exit 0, zero mem-zero violations).
The sp_int helper functions these tests call have varied, narrow definition
guards in sp_int.c (e.g. sp_div_2d/sp_mod_2d/sp_mul_2d/sp_tohex need
WOLFSSL_SP_MATH_ALL && !WOLFSSL_RSA_VERIFY_ONLY; the ct helpers need HAVE_ECC;
sp_gcd needs !NO_RSA && WOLFSSL_KEY_GEN). The previous
(WOLFSSL_SP_MATH_ALL || WOLFSSL_SP_MATH) && WOLFSSL_PUBLIC_MP guard let the
tests compile in configs where some of those helpers are not built, producing
undefined-reference link errors (sp_gcd, sp_div_2d, ...) in builds like
--enable-curl and the pq-small matrix configs. Replace it with the union of
the helpers' requirements, which the campaign sp-math config satisfies so
coverage is unchanged, and drop the now-redundant per-call sp_gcd guard.
Three more config-specific failures surfaced once the ecc link error was
resolved:
- test_wolfmath.c: test_wc_SpIntExptGcdDecisionCoverage called sp_gcd, whose
definition (sp_int.c) is guarded by !NO_RSA && WOLFSSL_KEY_GEN - narrower
than its sp_int.h prototype (|| ). Guard the sp_gcd block with the same
condition so builds like --enable-curl (RSA on, key-gen off) link.
- test_cmac.c: the crypto-cb badlen callback dereferences wc_CryptoInfo's
cmac member (WOLFSSL_CMAC only) and uses the Cmac type, but was guarded by
WOLF_CRYPTO_CB alone; configs with the callback framework but no CMAC
(e.g. --enable-wolftpm) failed to compile. Match the callback's guard to
its only caller (WOLFSSL_CMAC && !NO_AES && WOLFSSL_AES_128 &&
WOLF_CRYPTO_CB).
- test_dsa.c: test_wc_DsaExportKeyRaw_individual_args re-initialized WC_RNG
three times but freed it once, leaking two DRBGs (caught by LeakSanitizer
in the --enable-all sanitizer build). Free the RNG before each re-init,
mirroring the existing DsaKey free-before-reinit.
Verified: --enable-curl and --enable-wolftpm build/link; --enable-all with
-fsanitize=leak runs unit.test leak-free (test_wc_DsaExportKeyRaw_individual_args
passes).
test_wc_EccDecisionCoverage2 broke the unit.test link in several CI
configs (net-snmp, C#/Rust wrappers, make check/analyze, etc.):
- The wc_ecc_check_r_s_range block calls mp_init/mp_read_radix/mp_copy/
mp_clear, which resolve to sp_* under WOLFSSL_SP_MATH_ALL and are only
exported with WOLFSSL_PUBLIC_MP. Add defined(WOLFSSL_PUBLIC_MP) to its
guard (matching the other mp_*-using blocks in this file).
- wc_ecc_export_point_der_compressed is WOLFSSL_LOCAL (hidden in a shared
library) so it is not linkable from the shared-library unit test. Drop
the four direct calls; its decision coverage is driven by the ecc
white-box (which includes ecc.c). The public compressed path
wc_ecc_export_x963_ex(...,1) is retained.
Verified: --enable-net-snmp and --enable-all (+WOLFSSL_PUBLIC_MP) both
build and link; unit.test passes.
BEFORE 15/65 (23.08%) -> AFTER 55/65 (84.62%) MC/DC on wolfcrypt/src/random.c,
measured across 5 native user_settings.h variants (default, WOLFSSL_SMALL_STACK,
WOLFSSL_SMALL_STACK_CACHE, WC_RNG_SEED_CB, CUSTOM_RAND_GENERATE_BLOCK) plus a
new tests/unit-mcdc/test_random_whitebox.c white-box supplement, in the
ISO 26262 per-module MC/DC campaign.
tests/api/test_random.c / test_random.h:
- Add test_wc_RNG_HealthTest_SHA256_Ext / test_wc_RNG_HealthTest_SHA512_Ext,
exercising the previously-untested ACVP-oriented extended health-test entry
points (wc_RNG_HealthTest_SHA256_ex, wc_RNG_HealthTest_SHA512_ex/_ex2):
nonce/personalization-string/additional-input/reseed-entropy presence and
absence, in both standard and prediction-resistance modes, including
"valid pointer + zero size" calls needed to isolate each leaf's size
operand independently of its pointer operand for MC/DC.
- Add test_wc_RNG_SeedCb (WC_RNG_SEED_CB custom seed callback: success,
failing callback, and no-callback-installed paths).
- Add test_wc_RNG_CustomRandBlock (CUSTOM_RAND_GENERATE_BLOCK bypass path).
- Add test_wc_RNG_DrbgDisable (wc_Sha256Drbg_Disable/Enable/IsDisabled and
the wc_Sha512Drbg_* equivalents: drbgType selection and the "can't disable
both" BAD_STATE_E guard).
- Extend existing HealthTest bad-parameter coverage (reseed-without-seedB on
wc_RNG_HealthTest_ex / wc_RNG_HealthTest_SHA512 / wc_RNG_HealthTest_SHA512_ex,
and the untested wc_RNG_HealthTest_SHA512_ex2 3-operand bad-parameter guard).
- Guard test_wc_GenerateSeed against CUSTOM_RAND_GENERATE_BLOCK, whose
wc_GenerateSeed() ladder intentionally has no implementation in that
configuration (would otherwise be a link error, not a test failure).
tests/unit-mcdc/test_random_whitebox.c (new):
- White-box #include of random.c closing two structurally-unreachable-via-API
leaves: Hash_gen()/Hash512_gen()'s "out != NULL && outSz != 0" false side,
and array_add()'s "dLen > 0 && sLen > 0 && dLen >= sLen" false sides.
Residuals (10 of 65, documented in db/modules.json / baselines.json in the
paired testing-repo change): 4 WOLFSSL_SMALL_STACK allocation-failure
branches (no fault injection); 4 Hash_DRBG_Init/Hash512_DRBG_Init chained
Hash_df(...)==DRBG_SUCCESS conditions (transform-failure, SHA-256/512 never
fail on valid input); 2 Hash_gen()/Hash512_gen() "outSz != 0" leaves that are
structurally unsatisfiable given the caller's own outSz normalization and
loop-bound arithmetic (not merely hard to reach).
Bugs/interactions found while bringing up the CUSTOM_RAND_GENERATE_BLOCK
build variant (reported, not source-fixed): (1) random.c's PollAndReSeed()
is guarded only by "#ifdef HAVE_HASHDRBG" (not also
"!defined(CUSTOM_RAND_GENERATE_BLOCK)" like _InitRng()) and its non-callback
path unconditionally calls wc_GenerateSeed(), whose implementation ladder has
an intentionally empty CUSTOM_RAND_GENERATE_BLOCK arm -- an undefined-symbol
link error if a user_settings.h ever forces HAVE_HASHDRBG on together with
CUSTOM_RAND_GENERATE_BLOCK (this campaign's config now avoids the
combination instead of forcing it). (2) on this host, glibc's vDSO-
accelerated getrandom() does not validate the output buffer before writing
to it: wc_GenerateSeed(non-NULL os, NULL output, sz) segfaults inside
getrandom_vdso() instead of returning an error, so
TEST_WC_GENERATE_SEED_PARAMS is deliberately left undefined in the campaign
config for this test-only bad-parameter block (documented in
configs/random/user_settings.base.h).
philljjandGitHub
Sean ParkinsonandGitHub
Daniel PouzznerandGitHub
JacobBarthelmehandGitHub
John Safranek
Daniele Lacamera
Tobias Frauenschläger
Andrew Hutchings
Eric Blankenhorn
Emma Stensland