check-source-text (rule I) flags error-code identifiers used as comparison
operands even inside comments. Reword three comments so the code name is no
longer written as "(ret == PUBLIC_KEY_E)" / "(ret != CRYPTOCB_UNAVAILABLE)"
(test_kdf.c, test_ed448.c); the bare token on its own is fine.
clang-tidy reported a possible 0-byte malloc in test_mlkem.c: the ML-KEM
key/ciphertext sizes come from wc_MlKemKey_*Size() queries, which the analyzer
cannot prove nonzero. Guard each XMALLOC with a >0 check so the allocation
size is provably positive; the ExpectNotNull() checks still catch a 0-size
query at runtime.
The FIPS build diverges from the OPEN build on KDF behavior these exhaustive
MC/DC probes assert: wc_HmacSetKey enforces the 14-byte HMAC_FIPS_MIN_KEY, so
wc_Tls13_HKDF_Extract with the short salt/ikm here returns HMAC_MIN_KEYLEN_E
(-200) instead of 0 (test_kdf.c:766), and wc_PRF with resLen==0 returns 0
instead of BAD_FUNC_ARG (test_kdf.c:118). kdf.c coverage is measured only in
non-FIPS campaign variants, so guard both test_wc_KdfDecisionCoverage and
test_wc_KdfFeatureCoverage bodies with !HAVE_FIPS && !HAVE_SELFTEST; they run
in full in OPEN builds and skip cleanly under FIPS/selftest. Verified against
a --enable-fips=v5 build (both now skip, 0 failures).
kdf: wc_Tls13_HKDF_Extract_ex / wc_Tls13_HKDF_Expand_Label_ex postdate the
frozen FIPS/selftest kdf.h and are undeclared there. Gate every _ex call site
behind WOLFSSL_TEST_HKDF_EX (!HAVE_FIPS && !HAVE_SELFTEST); the thin non-_ex
wrappers, which exist everywhere, keep their coverage.
wolfmath: test_wc_TfmDecisionCoverage / test_wc_TfmExptModDecisionCoverage /
test_wc_IntegerDecisionCoverage called library-internal fp_* and s_mp_*
functions that carry no MP_API decoration, so under -fvisibility=hidden they
are not exported from the shared library and unit.test failed to link them
(undefined reference to fp_set / s_mp_mul_digs / ...) in the default shared CI
build. Relocate those decision drivers into the tests/unit-mcdc white-boxes,
which reach the internals legally by #including tfm.c / integer.c; tests/api
now uses only the public mp_* interface. mp_rand_prime calls are gated by
WOLFSSL_KEY_GEN (and, for integer, !NO_DH || !NO_DSA) to match where the
library declares and defines it.
Under DEBUG_WOLFSSL, wc_HashUpdate/Final/Free first check (hash->type != type)
and return BAD_FUNC_ARG before the switch, so the "unsupported type ->
HASH_TYPE_E" arm is unreachable on an uninitialized hash (wc_HashInit refuses
those types). Guard those Update/Final/Free assertions with #ifndef
DEBUG_WOLFSSL; the arm's coverage comes from non-DEBUG variants in the union.
Fixes the cmake (old-TLS/debug) build failure. wc_HashInit assertions keep
running (Init has no such type check).
This bug is fixed in PR #10927
test_wolfSSL_read_write_ex hard-coded the close-notify exchange as
NOT_DONE/NOT_DONE/SUCCESS/SUCCESS, which is protocol-version/config dependent
and fails under the cmake old-TLS build. Loop wolfSSL_shutdown on each side
until WOLFSSL_SUCCESS (pre-existing flake, not from this PR's new tests).
Merge the _gap white-box drivers into their base file (tfm, integer, ed448,
mldsa, mlkem_poly, slhdsa, xmss_impl) and delete the _gap copies; a single
binary per source also satisfies more MC/DC independence pairs (tfm 89->91,
integer 92->100, mlkem_poly 25->27, mldsa 252->256). LMS is kept as two files:
its sign-side drivers reference internals absent under verify-only/small
builds and use per-driver state that does not share one main() safely.
Close API-reachable and file-static MC/DC gaps identified by the per-module
GAPS.md reports (+291 conditions across the union):
tfm.c 71->89, integer.c 49->92, ed448.c 62->92 (91%), wc_slhdsa.c 99->155
(88%), wc_mldsa.c 169->252, wc_mlkem.c 46->65 (96%), wc_lms_impl.c 60->82,
wc_xmss_impl.c 38->57.
Enriched DecisionCoverage in test_wolfmath.c (tfm/integer), test_ed448.c,
test_slhdsa.c; new arg/state/length cases in test_mldsa.c/test_mlkem.c; and
per-source *_gap white-box supplements under tests/unit-mcdc/ driving the
static internals (WOTS/FORS/NTT/poly/Merkle/comba/Montgomery, etc.). Remaining
uncovered conditions are justified residuals (AVX2/cpuid dispatch on an
always-AVX2 host, deep alloc/crypto-failure err-chains, asm-only paths).
Copilot review (test_random.c:1238): test_wc_DrbgFeatureCoverage claimed a
bounded burst of generate calls crosses WC_RESEED_INTERVAL, but the default
interval is 1,000,000 so 40 generates never reach it and the
DRBG_NEED_RESEED -> PollAndReSeed branch was not exercised in normal builds.
Force the path instead: probe one generate to confirm the Hash_DRBG path is
active (skipped under e.g. --enable-intelrand), then set the active DRBG's
reseedCtr to WC_RESEED_INTERVAL - 1 and generate across it, asserting the
reseed resets the counter (same idiom as test_wc_RNG_ReseedBoundary), for
both SHA-256 and SHA-512 DRBG widths. Comment corrected to match.
- CMakeLists.txt: register the new tests/api sources (test_kdf.c,
test_coding.c, test_error.c, test_wolfentropy.c) with the unit_test
target; fixes cmake link failure (undefined
test_wc_GetErrorStringDecisionCoverage/test_wc_ErrorStringDecisionCoverage).
- tests/api/test_mldsa.c: guard the wc_MlDsaKey_MakeKey NULL-arg checks
in test_wc_MldsaDecisionCoverage with WOLFSSL_MLDSA_NO_MAKE_KEY; fixes
link failure in verify-only builds (tinytls13-psk-mldsa,
all-pq-verify-only-noasm).
- tests/unit-mcdc/*: reword 'statics' to 'static helpers' in comments to
satisfy codespell.
Under DEBUG_WOLFSSL the hash->type != type check in wc_HashUpdate,
wc_HashFinal and wc_HashFree fired for an uninitialized hash
(hash->type == WC_HASH_TYPE_NONE), returning BAD_FUNC_ARG where a non-debug
build returns HASH_TYPE_E from the type switch, so the returned error code
depended on whether DEBUG_WOLFSSL was defined. Only apply the mismatch check
to initialized hashes; the genuine init-then-wrong-type misuse check is
preserved.
The LMS and XMSS X.509 generation tests persist their stateful private
keys through read/write callbacks to hardcoded /tmp paths
(/tmp/wolfssl_test_lms.key, /tmp/wolfssl_test_xmss_gen.key). When
make check runs multiple configs in parallel on a shared /tmp (CI
shards), concurrent unit.test processes clobber the same file; a
subsequent read then gets a different-sized key and signing fails with
IO_FAILED_E (e.g. test_rfc9802_xmss_x509_gen returning -291).
Give the LMS and XMSS test key-file paths a per-process name via
getpid(), guarded by HAVE_GETPID/WOLFSSL_NO_GETPID with <unistd.h>
included under the same guard and a plain-path fallback, so the file
still compiles on Windows / NO_WOLFSSL_DIR / no-OS builds. Verified by
racing six concurrent unit.test processes: 5/6 failed before, 6/6 pass
after; the HAVE_GETPID and fallback paths both compile clean under
-Werror.
```
==485951== Uninitialised value was created by a stack allocation
==485951== at 0x207D47: des3_key_wrap_test (test.c:12773)
```
and
```
==485951== Uninitialised value was created by a stack allocation
==485951== at 0x3A075E: test_wc_AesGcmArgMcdc (test_aes.c:8968)
```
test_pkcs7.c: test_wc_PKCS7_BER also accepts ret >= 0 (Bleichenbacher mitigation hides the RSA key error, making the result non-deterministic).
suites.c: skip --send-ticket cases as NOT_BUILT_IN when HAVE_SESSION_TICKET
is off (avoids port-11111 race).
The RISC-V ASM build provides its own AES-GCM implementation
(wolfcrypt/src/port/riscv/riscv-64-aes.c) rather than AES_GCM_decrypt_C, so
it does not clear the output buffer on authentication failure. Exclude it
from the zero-check, matching the other non-C decrypt paths. Fixes the
riscv64 multi-arch testwolfcrypt failure.
Skoll review of the auth-fail zero-check test in aesgcm_test:
- The guard listed WOLFSSL_ARMASM_NO_HW_CRYPTO and __aarch64__, which are
defined on default x86-64 builds, so the zero-check block was compiled out
and the assertion never actually ran there. They are subsumed by
WOLFSSL_ARMASM (the condition under which AES_GCM_decrypt_C is not the
decrypt path), so use that instead and the check runs on the C path.
- Exclude WC_AES_GCM_DEC_AUTH_EARLY (out is not written on an early-auth
failure) and WOLFSSL_ASYNC_CRYPT (a real async device may offload the
decrypt and not clear the output).
Verified: default make check passes with the zero-check now executing;
testwolfcrypt AES-GCM passes with --enable-aesni and with
-DWC_AES_GCM_DEC_AUTH_EARLY.
check-source-text reports these as unneeded because the macros are now
defined in the checked build config, so their known-extra whitelist entries
are redundant:
WOLFSSL_ASN_TEMPLATE_NEED_SET_INT32
WOLFSSL_ASYNC_CERT_YIELD
WOLFSSL_MLKEM_DYNAMIC_KEYS
Review follow-ups for the constant-time AES-GCM decrypt output clear:
- Guard the output-masking pass with #ifndef WC_AES_GCM_DEC_AUTH_EARLY. In
that configuration the tag is verified before decryption and a mismatch
returns before any output is written, so the masking pass is a guaranteed
no-op; skipping it avoids a wasted O(sz) pass.
- Add a test in aesgcm_test: decrypt with a corrupted tag into a pre-filled
buffer and assert wc_AesGcmDecrypt returns AES_GCM_AUTH_E and, on the
software C path, that the output buffer is cleared to zero. The AES-NI/asm
decrypt paths and the FIPS module do not clear the output on auth failure,
so the zero check forces the C path (use_aesni = 0) and is limited to it
(and skipped under HAVE_FIPS). The AES_GCM_AUTH_E comparison uses
WC_NO_ERR_TRACE().
Verified (gcc 15.2): make check passes on the default (C path) build;
testwolfcrypt AES-GCM passes with --enable-aesni and with
-DWC_AES_GCM_DEC_AUTH_EARLY; ct-valgrind aes_gcm reports 0 errors.
AES_GCM_decrypt_C cleared the output on a tag mismatch with
'if (ret != 0) ForceZero(out, sz)'. That is a conditional branch on the
secret-dependent authentication result, which is not constant time and is
flagged by the ct-valgrind constant-time test (Conditional jump depends on
uninitialised value in AES_GCM_decrypt_C).
Mask the output with 'res' (already computed as all-ones on tag mismatch,
zero on match) instead of branching, matching the constant-time idiom used
for the tag comparison itself. C path only; the AES-NI/ASM paths are
unaffected.
Daniele Lacamera
jackctj117andGitHub
JacobBarthelmehandGitHub
kaleb-himes
Josh Holtrop
Sean Parkinson
Daniel PouzznerandGitHub
Emma Stensland
Tobias FrauenschlägerandDaniele Lacamera
Andrew Hutchings
aidan garske
Takashi Kojo
Hideki Miyazaki