The LMS and XMSS X.509 generation tests persist their stateful private
keys through read/write callbacks to hardcoded /tmp paths
(/tmp/wolfssl_test_lms.key, /tmp/wolfssl_test_xmss_gen.key). When
make check runs multiple configs in parallel on a shared /tmp (CI
shards), concurrent unit.test processes clobber the same file; a
subsequent read then gets a different-sized key and signing fails with
IO_FAILED_E (e.g. test_rfc9802_xmss_x509_gen returning -291).
Give the LMS and XMSS test key-file paths a per-process name via
getpid(), guarded by HAVE_GETPID/WOLFSSL_NO_GETPID with <unistd.h>
included under the same guard and a plain-path fallback, so the file
still compiles on Windows / NO_WOLFSSL_DIR / no-OS builds. Verified by
racing six concurrent unit.test processes: 5/6 failed before, 6/6 pass
after; the HAVE_GETPID and fallback paths both compile clean under
-Werror.
```
==485951== Uninitialised value was created by a stack allocation
==485951== at 0x207D47: des3_key_wrap_test (test.c:12773)
```
and
```
==485951== Uninitialised value was created by a stack allocation
==485951== at 0x3A075E: test_wc_AesGcmArgMcdc (test_aes.c:8968)
```
test_pkcs7.c: test_wc_PKCS7_BER also accepts ret >= 0 (Bleichenbacher mitigation hides the RSA key error, making the result non-deterministic).
suites.c: skip --send-ticket cases as NOT_BUILT_IN when HAVE_SESSION_TICKET
is off (avoids port-11111 race).
The RISC-V ASM build provides its own AES-GCM implementation
(wolfcrypt/src/port/riscv/riscv-64-aes.c) rather than AES_GCM_decrypt_C, so
it does not clear the output buffer on authentication failure. Exclude it
from the zero-check, matching the other non-C decrypt paths. Fixes the
riscv64 multi-arch testwolfcrypt failure.
Skoll review of the auth-fail zero-check test in aesgcm_test:
- The guard listed WOLFSSL_ARMASM_NO_HW_CRYPTO and __aarch64__, which are
defined on default x86-64 builds, so the zero-check block was compiled out
and the assertion never actually ran there. They are subsumed by
WOLFSSL_ARMASM (the condition under which AES_GCM_decrypt_C is not the
decrypt path), so use that instead and the check runs on the C path.
- Exclude WC_AES_GCM_DEC_AUTH_EARLY (out is not written on an early-auth
failure) and WOLFSSL_ASYNC_CRYPT (a real async device may offload the
decrypt and not clear the output).
Verified: default make check passes with the zero-check now executing;
testwolfcrypt AES-GCM passes with --enable-aesni and with
-DWC_AES_GCM_DEC_AUTH_EARLY.
check-source-text reports these as unneeded because the macros are now
defined in the checked build config, so their known-extra whitelist entries
are redundant:
WOLFSSL_ASN_TEMPLATE_NEED_SET_INT32
WOLFSSL_ASYNC_CERT_YIELD
WOLFSSL_MLKEM_DYNAMIC_KEYS
Review follow-ups for the constant-time AES-GCM decrypt output clear:
- Guard the output-masking pass with #ifndef WC_AES_GCM_DEC_AUTH_EARLY. In
that configuration the tag is verified before decryption and a mismatch
returns before any output is written, so the masking pass is a guaranteed
no-op; skipping it avoids a wasted O(sz) pass.
- Add a test in aesgcm_test: decrypt with a corrupted tag into a pre-filled
buffer and assert wc_AesGcmDecrypt returns AES_GCM_AUTH_E and, on the
software C path, that the output buffer is cleared to zero. The AES-NI/asm
decrypt paths and the FIPS module do not clear the output on auth failure,
so the zero check forces the C path (use_aesni = 0) and is limited to it
(and skipped under HAVE_FIPS). The AES_GCM_AUTH_E comparison uses
WC_NO_ERR_TRACE().
Verified (gcc 15.2): make check passes on the default (C path) build;
testwolfcrypt AES-GCM passes with --enable-aesni and with
-DWC_AES_GCM_DEC_AUTH_EARLY; ct-valgrind aes_gcm reports 0 errors.
AES_GCM_decrypt_C cleared the output on a tag mismatch with
'if (ret != 0) ForceZero(out, sz)'. That is a conditional branch on the
secret-dependent authentication result, which is not constant time and is
flagged by the ct-valgrind constant-time test (Conditional jump depends on
uninitialised value in AES_GCM_decrypt_C).
Mask the output with 'res' (already computed as all-ones on tag mismatch,
zero on match) instead of branching, matching the constant-time idiom used
for the tag comparison itself. C path only; the AES-NI/ASM paths are
unaffected.
linuxkm/lkcapi_aes_glue.c: zero the ephemeral ivOut in AesGcmCrypt_1().
wolfcrypt/src/port/kcapi/kcapi_aes.c: tighten the test on the return value from kcapi_aead_decrypt().
wc_RsaFunction is declared WOLFSSL_API but the FIPS module does not export
it, so test_wc_RsaDecisionCoverage's 7-condition wc_RsaFunction arg-check
block fails to link (undefined reference) across the FIPS legs. Exclude the
block under HAVE_FIPS; cipher/plain/key/rng stay used by the other checks,
so no unused-variable. Not frozen under self-test, so it stays there.
check-source-text flags error-code operands compared without
WC_NO_ERR_TRACE(). Wrap them in the ed25519 and cmac white-box binaries
(same fix already applied to the curve25519 white-box).
The frozen FIPS/self-test hmac's wc_HmacSizeByType returns HMAC_KAT_FIPS_E
(-206) for any type it doesn't accept - not just the invalid 9999 case but
also MD5 (not a FIPS HMAC type), which returned -206 instead of the digest
size. Rather than chase each type, exclude the whole function under
HAVE_SELFTEST/HAVE_FIPS (the campaign measures MC/DC on open builds only).
- test_cmac.c: wc_AesCmacGenerate_ex / wc_AesCmacVerify_ex are absent from
the frozen FIPS cmac.h (fips-check freezes cmac.h at WCv4-stable /
WCv5.0-RC12 / v5.2.1-stable, none of which declare the _ex variants), so
the DecisionCoverage + cryptocb tests calling them fail to compile on the
FIPS legs. Add !defined(HAVE_FIPS) to their guards. cmac is NOT frozen
under CAVP self-test, so no HAVE_SELFTEST clause is needed.
- test_random.c: the WC_RNG_SEED_CB callbacks (test_random_seedCb_ok/_fail)
were guarded #ifdef WC_RNG_SEED_CB, but their only caller test_wc_RNG_SeedCb
is additionally !HAVE_SELFTEST && !HAVE_FIPS; a fips-ready build with
WC_RNG_SEED_CB on compiled the statics but not the caller ->
-Werror=unused-function. Match the statics' guard to the caller's.
- test_dh.c: zero-initialize priv/pub in test_wc_DhCheckKeyPair. clang-tidy
flags pub[pubSz-1] ^= 0x01 as a read of an uninitialized variable (it
cannot see that wc_DhGenerateKeyPair fills pub at runtime), failing
all-c89-clang-tidy / clang-tidy-all-intelasm / clang-tidy-all-async-quic.
- test_curve25519_whitebox.c: wrap the BAD_FUNC_ARG operands in
WC_NO_ERR_TRACE() (check-source-text unescaped-error-code check).
- test_sha3_whitebox.c: drop the bogus WOLFSSL_NO_SHA3 guard (no such
macro; the real gate is WOLFSSL_SHA3), which check-source-text reported
as an unknown macro.
test_wc_SpIntExptGcdDecisionCoverage sized r with sp_init_size(&r, 2)
expecting sp_gcd(2^140, 2^70, &r) == 0, on the assumption that 2^70
occupies 2 digits. That only holds for 64-bit SP_WORD_SIZE; on a 32-bit
build (e.g. --enable-sp-math-all with ALT_ECC_SIZE under -m32) 2^70 spans
3 digits, so r->size(2) < b->used(3) trips sp_gcd's dest-size check and it
returns MP_VAL. Size r to b.used so the "r->size < b->used" operand stays
false (the intended MC/DC pair) for any word size.
test_wc_CmacFinal declares tooSmallMacSz but only uses it inside the
"#if (!HAVE_FIPS || FIPS>=5.3) && !HAVE_SELFTEST" block (wc_CmacFinalNoFree
bad-arg checks). Under the CAVP-selftest config that block is compiled out,
leaving the variable unused -> -Werror=unused-variable. Declare it under the
same condition as its use.
The CAVP-selftest-v2 CI leg configures with --enable-dsa --enable-keygen
(richer than the minimal selftest profile), so it compiles two more
functions that call wolfCrypt APIs absent from the frozen v4.1.0 module:
- test_wc_DsaSign_bad_digestSz -> wc_DsaSign_ex / wc_DsaVerify_ex
- test_wc_DhGenerateParams_and_ExportRaw -> wc_DhGenerateParams /
wc_DhExportParamsRaw
Exclude both from HAVE_SELFTEST / HAVE_FIPS builds. Only a frozen build
run under the CAVP config (DSA + keygen on) exposes these.
test_wc_EccDecisionCoverage3 calls wc_ecc_import_unsigned and
wc_ecc_rs_raw_to_sig, which are not available in the frozen
CAVP-selftest wolfCrypt module (their declarations are gated off by the
minimal selftest feature config), so the CAVP-selftest CI leg fails to
compile them under -Werror. Exclude the function from HAVE_SELFTEST /
HAVE_FIPS builds, matching the sibling EccDecisionCoverage functions.
This class is only visible via an actual --enable-selftest compile, not
a header symbol diff.
The FIPS and CAVP-selftest CI legs overlay an ancient frozen wolfCrypt
per module (selftest ~= wc 4.1.0; FIPS v2 = WCv4-stable, older still).
New MC/DC tests call post-freeze wc_* APIs absent from those modules,
which fails to compile under -Werror on those legs. The campaign only
measures MC/DC on open per-module builds, never on FIPS/selftest, so
these functions gain no coverage there and only risk breaking CI.
Guard every affected test function with
!defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) so it compiles out in
frozen builds, determined by diffing each header against both
v4.1.0-stable (selftest) and WCv4-stable (oldest FIPS v2):
- test_dh.c: SetNamedKey/CheckPubKey/CheckPrivKey/CheckKeyPair/
GenerateKeyPair* /Agree/ImportExport/SetKey (named-key, FFDHE,
DhAgree_ct, DhGeneratePublic, DhSetCheckKey - the last v2-only)
- test_ecc.c: mulmod + EccDecisionCoverage/2/4 (key_get_priv,
import_point_der_ex, gen_k, init_label, ctx_set_kdf_salt, ...)
- test_dsa.c: DsaKeyToPublicDer (add FIPS clause to existing selftest guard)
- test_hmac.c: HmacInit_Label, HmacInit_Id (wc_HmacInit_Id v2-only)
- test_random.c: RNG_SeedCb (wc_SetSeed_Cb)
- test_rsa.c: RsaFeatureCoverage (wc_InitRsaKey_Label)
- test_sha512.c: sha512 cryptocb fallback / default-devid variants
test_aes.c already handles this via per-feature guards (PR #10845).
Open build stays warning-clean and all guarded tests still run there.
Two MC/DC tests asserted pre-fix behavior; the corresponding library
fixes changed the observable result:
- test_wc_DsaImportParamsRaw_individual_args: the untrusted-import
primality rejection now surfaces DH_CHECK_PUB_E, since CheckDsaLN is
gated on err==MP_OKAY (commit 30ceba03c) and no longer overwrites it
with BAD_FUNC_ARG.
- test_wc_curve25519_check_public_be: the big-endian "order or higher"
loop now compares pub[i] != 0xff (symmetric with the little-endian
branch, commit 600880a0a), so the rejection input needs pub[1..30]
== 0xff, not 0x00.
Updated the assertions and the now-stale explanatory comments. Both
groups pass under --enable-all --enable-intelasm; full make check green.
The mem-zero false-positive these calls tripped is fixed at the library
level in wc_MakeRsaKey() on the sibling branch (fixes-2026-07-10 / PR
10875), which zero-initializes its stack temporaries so the early-out
mp_memzero_check() is safe. Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the
RsaSizeCheck decision is exercised in the instrumented build too. Depends
on PR 10875 for the all-check-mem-zero config.
The mem-zero registration leak this guard worked around is fixed at the
library level in wc_FreeDhKey() on the sibling branch (fixes-2026-07-10 /
PR 10875). Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the import/export test
runs and validates that fix. This test therefore depends on PR 10875 to
pass the all-check-mem-zero CI config.
test_wc_DhGenerateParams_and_ExportRaw asserted wc_DhGenerateParams()==0,
but the bare WOLFSSL_SP_MATH backend cannot generate DH domain parameters
(returns PRIME_GEN_E), so the all-pq-sp-math CI config (--enable-sp-math)
failed the assertion. Guard the test on !defined(WOLFSSL_SP_MATH); the
generate/export decisions are covered with WOLFSSL_SP_MATH_ALL, fastmath
and heapmath. Verified: --enable-sp-math unit.test passes (test skipped);
the test still runs under --enable-all.
The all-check-mem-zero CI config (--enable-all -DWOLFSSL_CHECK_MEM_ZERO)
aborted unit.test (exit 134) in two of the new decision-coverage tests.
Both stem from wolfSSL mem-zero-tracking gaps that these tests are the
first to exercise; the underlying decisions are covered in every normal
build, so guard the specific triggers out of the instrumented build:
- test_rsa.c (test_wc_RsaDecisionCoverage): calling wc_MakeRsaKey() with an
out-of-range size makes it 'goto out' and run mp_memzero_check() over its
not-yet-initialized local temporaries, which over-scans the stack and
false-positives on the still-registered, legitimately non-zero key->d of
the key made earlier in the test. Skip the two bad-size calls under the
instrumented build.
- test_dh.c (test_wc_DhImportExportKeyPair): wc_DhImportKeyPair() registers
key->priv via mp_memzero_add(), but wc_FreeDhKey() clears it with
mp_forcezero() (which does not deregister) and has no wc_MemZero_Check()
like wc_FreeRsaKey() does, so the registration leaks into later tests.
Skip this import/export test under the instrumented build.
Verified: --enable-all -DWOLFSSL_CHECK_MEM_ZERO builds and unit.test passes
(exit 0, zero mem-zero violations).
The sp_int helper functions these tests call have varied, narrow definition
guards in sp_int.c (e.g. sp_div_2d/sp_mod_2d/sp_mul_2d/sp_tohex need
WOLFSSL_SP_MATH_ALL && !WOLFSSL_RSA_VERIFY_ONLY; the ct helpers need HAVE_ECC;
sp_gcd needs !NO_RSA && WOLFSSL_KEY_GEN). The previous
(WOLFSSL_SP_MATH_ALL || WOLFSSL_SP_MATH) && WOLFSSL_PUBLIC_MP guard let the
tests compile in configs where some of those helpers are not built, producing
undefined-reference link errors (sp_gcd, sp_div_2d, ...) in builds like
--enable-curl and the pq-small matrix configs. Replace it with the union of
the helpers' requirements, which the campaign sp-math config satisfies so
coverage is unchanged, and drop the now-redundant per-call sp_gcd guard.
aidan garske
JacobBarthelmehandGitHub
Daniel PouzznerandGitHub
Tobias FrauenschlägerandDaniele Lacamera
Andrew Hutchings
Sean Parkinson
Takashi Kojo
Daniele Lacamera
philljjandGitHub
Eric Blankenhorn
Mattia MoffaandGitHub