MC/DC: coverage campaign part 9

src/ssl.c

@@ -3871,16 +3871,20 @@ int wolfssl_local_IsValidFQDN(const char* name, word32 nameSz)
     int curLabelHasAlpha = 0;
     int curLabelHasUnderscore = 0;
 
-    if (name == NULL || nameSz == 0)
+    if (name == NULL || nameSz == 0 || nameSz > 254)
         return 0;
 
+    /* Bound before touching name[]: a valid name is at most 253 octets
+     * plus an optional trailing dot, so longer sizes are rejected here
+     * without reading past the caller's buffer.
+     */
     /* Strip a single optional trailing dot before measuring.  "example.com."
      * is the absolute form of the same FQDN.
      */
     if (name[nameSz - 1] == '.')
         --nameSz;
 
-    if (nameSz < 1 || nameSz > 253)
+    if (nameSz > 253)
         return 0;
 
     for (i = 0; i < nameSz; i++) {

tests/api/check-api-guards.py

@@ -64,6 +64,13 @@
     'wolfSSL_CertManagerVerify':     (['NO_FILESYSTEM'], []),
     'wolfSSL_CertManagerLoadCRL':    (['NO_FILESYSTEM'], []),
     'wolfSSL_CertManagerLoadCRLFile': (['NO_FILESYSTEM'], []),
+    # src/ssl.c: implemented under HAVE_SECURE_RENEGOTIATION ||
+    # HAVE_SERVER_RENEGOTIATION_INFO; the substring match passes a call
+    # site guarded by the full disjunction.
+    'wolfSSL_SSL_renegotiate_pending':  ([], ['HAVE_SECURE_RENEGOTIATION']),
+    # src/ssl_load.c: implemented under !NO_FILESYSTEM && !NO_CERTS
+    'wolfSSL_CTX_use_PrivateKey_file':  (['NO_FILESYSTEM', 'NO_CERTS'], []),
+    'wolfSSL_CTX_use_certificate_file': (['NO_FILESYSTEM', 'NO_CERTS'], []),
 }
 
 

tests/api/test_aes.c

@@ -14869,3 +14869,213 @@ int test_wc_AesGcm_PrimitiveFailureCleanup(void)
 #endif
     return EXPECT_RESULT();
 }
+
+/* MC/DC pairs the 2026 upstream aes.c changes left open: the GcmInit/
+ * GcmSetIV argument-clause tails, the zero-length key id, the CTR
+ * leftover-keystream loop with an empty request, and the XTS unset-key
+ * guard on both sides.
+ *
+ * Excluded under HAVE_SELFTEST: the CAVP self-test leg compiles the frozen
+ * wolfCrypt 4.1.0 aes.c, whose GCM-stream/XTS/CTR paths predate these
+ * guards, so the open aes.c this measures is not the one built (same
+ * exclusion as the AesFeatureCoverage GCM/CCM blocks). FIPS modules also
+ * use different AES paths and do not provide every public size constant. */
+int test_wc_AesReworkDecisionCoverage(void)
+{
+    EXPECT_DECLS;
+#if !defined(NO_AES) && defined(WOLFSSL_AES_128) && \
+    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) && \
+    (defined(HAVE_AESGCM) || defined(WOLFSSL_AES_COUNTER) || \
+     defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_XTS))
+    Aes        aes;
+    byte       key16[16];
+    byte       iv[WC_AES_BLOCK_SIZE];
+    byte       ivFixed[AES_IV_FIXED_SZ];
+#if defined(HAVE_AESGCM)
+    byte       tag[WC_AES_BLOCK_SIZE];
+#endif
+#if defined(WOLF_PRIVATE_KEY_ID)
+    byte       id[8];
+#endif
+#if defined(HAVE_AESGCM) || defined(WOLFSSL_AES_COUNTER) || \
+    defined(WOLFSSL_AES_CFB) || defined(WOLFSSL_AES_XTS)
+    byte       in[32];
+    byte       out[32];
+#endif
+#if !defined(WC_NO_RNG)
+    WC_RNG     rng;
+#endif
+#if defined(WOLFSSL_AES_XTS)
+    XtsAes     xaes;
+#endif
+
+    XMEMSET(key16, 1, sizeof(key16));
+    XMEMSET(iv, 2, sizeof(iv));
+    XMEMSET(ivFixed, 3, sizeof(ivFixed));
+#if defined(HAVE_AESGCM)
+    XMEMSET(tag, 4, sizeof(tag));
+#endif
+#if defined(WOLF_PRIVATE_KEY_ID)
+    XMEMSET(id, 4, sizeof(id));
+#endif
+#if defined(HAVE_AESGCM) || defined(WOLFSSL_AES_COUNTER) || \
+    defined(WOLFSSL_AES_CFB) || \
+    defined(WOLFSSL_AES_XTS)
+    XMEMSET(in, 5, sizeof(in));
+#endif
+#if !defined(WC_NO_RNG)
+    XMEMSET(&rng, 0, sizeof(rng));
+#endif
+
+    /* wc_AesGcmEncryptInit() -> wc_AesGcmInit(): (ivSz > 0) false with iv
+     * NULL, the clause tail (stream API only). */
+#if defined(HAVE_AESGCM) && defined(WOLFSSL_AESGCM_STREAM)
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmEncryptInit(&aes, key16, sizeof(key16), NULL, 0),
+        0);
+    /* (ivSz > 0) true with iv NULL: the clause fires. */
+    ExpectIntEQ(wc_AesGcmEncryptInit(&aes, key16, sizeof(key16), NULL, 12),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    wc_AesFree(&aes);
+#endif
+    /* wc_AesGcmSetIV(): ivFixedSz == AES_IV_FIXED_SZ (clause tail); the
+     * remaining IV bytes come from the RNG. */
+#if defined(HAVE_AESGCM) && !defined(WC_NO_RNG)
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmSetKey(&aes, key16, sizeof(key16)), 0);
+    ExpectIntEQ(wc_InitRng_ex(&rng, HEAP_HINT, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmSetIV(&aes, GCM_NONCE_MIN_SZ, ivFixed,
+                               sizeof(ivFixed), &rng), 0);
+    /* (ivFixedSz != AES_IV_FIXED_SZ) true: the clause fires. */
+    ExpectIntEQ(wc_AesGcmSetIV(&aes, 12, ivFixed, 12, &rng),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    /* rng == NULL side of the guard, isolated with a valid fixed part. */
+    ExpectIntEQ(wc_AesGcmSetIV(&aes, GCM_NONCE_MIN_SZ, ivFixed,
+                               sizeof(ivFixed), NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    /* ivFixed == NULL: the whole IV comes from the RNG. */
+    ExpectIntEQ(wc_AesGcmSetIV(&aes, 12, NULL, 0, &rng), 0);
+    /* Invalid IV size: not 8, 12, or 16. */
+    ExpectIntEQ(wc_AesGcmSetIV(&aes, 13, ivFixed, 12, &rng),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    wc_AesFree(&aes);
+    DoExpectIntEQ(wc_FreeRng(&rng), 0);
+#endif
+
+    /* wc_AesInit_Id(): non-NULL id with zero length is a valid tag. */
+#if defined(WOLF_PRIVATE_KEY_ID)
+    ExpectIntEQ(wc_AesInit_Id(&aes, id, 0, NULL, INVALID_DEVID), 0);
+    wc_AesFree(&aes);
+#endif
+
+    /* CTR leftover-keystream loop: a partial block leaves aes->left, an
+     * empty request evaluates the loop with sz == 0, draining left to zero
+     * with data pending evaluates the loop with left == 0. */
+#if defined(WOLFSSL_AES_COUNTER)
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesSetKey(&aes, key16, sizeof(key16), iv, AES_ENCRYPTION),
+        0);
+    ExpectIntEQ(wc_AesSetIV(&aes, iv), 0);
+    ExpectIntEQ(wc_AesCtrEncrypt(&aes, out, in, 5), 0);
+    ExpectIntEQ(wc_AesCtrEncrypt(&aes, out, in, 0), 0);
+    ExpectIntEQ(wc_AesCtrEncrypt(&aes, out, in, 3), 0);
+    ExpectIntEQ(wc_AesCtrEncrypt(&aes, out, in, 8), 0);
+    ExpectIntEQ(wc_AesCtrEncrypt(&aes, out, in, 3), 0);
+    wc_AesFree(&aes);
+#endif
+
+    /* CFB decrypt chunk loop: exactly two blocks drains sz below the loop
+     * threshold inside the loop, evaluating the false side. */
+#if defined(WOLFSSL_AES_CFB) && defined(HAVE_AES_DECRYPT)
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    /* CFB always uses the forward cipher for both directions. */
+    ExpectIntEQ(wc_AesSetKey(&aes, key16, sizeof(key16), iv, AES_ENCRYPTION),
+        0);
+    ExpectIntEQ(wc_AesSetIV(&aes, iv), 0);
+    ExpectIntEQ(wc_AesCfbDecrypt(&aes, out, in, 2 * WC_AES_BLOCK_SIZE), 0);
+    wc_AesFree(&aes);
+#endif
+
+#if defined(WOLFSSL_AES_XTS)
+    XMEMSET(&xaes, 0, sizeof(xaes));
+    /* keylen == 0 side of the unset-key guard, both directions. */
+    ExpectIntEQ(wc_AesXtsEncrypt(&xaes, out, in, sizeof(in), iv, sizeof(iv)),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#ifdef HAVE_AES_DECRYPT
+    ExpectIntEQ(wc_AesXtsDecrypt(&xaes, out, in, sizeof(in), iv, sizeof(iv)),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+    /* rounds == 0 side: a key length with no software schedule. */
+    xaes.aes.keylen = (int)sizeof(key16);
+    ExpectIntEQ(wc_AesXtsEncrypt(&xaes, out, in, sizeof(in), iv, sizeof(iv)),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#ifdef HAVE_AES_DECRYPT
+    ExpectIntEQ(wc_AesXtsDecrypt(&xaes, out, in, sizeof(in), iv, sizeof(iv)),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+    /* keylen == 0 with rounds set: the OR's first operand alone. */
+    xaes.aes.keylen = 0;
+    xaes.aes.rounds = 10;
+    ExpectIntEQ(wc_AesXtsEncrypt(&xaes, out, in, sizeof(in), iv, sizeof(iv)),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#ifdef HAVE_AES_DECRYPT
+    ExpectIntEQ(wc_AesXtsDecrypt(&xaes, out, in, sizeof(in), iv, sizeof(iv)),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+#endif
+
+    /* wc_AesGcmInit(): direct argument checks - (ivSz > 0) with iv NULL is
+     * the last clause, (ivSz == 0) with iv NULL is the clean path. */
+#if defined(HAVE_AESGCM) && defined(WOLFSSL_AESGCM_STREAM)
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmInit(&aes, key16, sizeof(key16), NULL, 0), 0);
+    ExpectIntEQ(wc_AesGcmInit(&aes, key16, sizeof(key16), NULL, 12),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    wc_AesFree(&aes);
+#endif
+
+    /* wc_AesGcmSetIV(): (ivFixed == NULL) with ivFixedSz == 0 - the pair
+     * for the (ivFixed != NULL) clause against the size-mismatch failure
+     * above. */
+#if defined(HAVE_AESGCM) && !defined(WC_NO_RNG)
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmSetKey(&aes, key16, sizeof(key16)), 0);
+    ExpectIntEQ(wc_InitRng_ex(&rng, HEAP_HINT, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmSetIV(&aes, 12, NULL, 0, &rng), 0);
+    wc_AesFree(&aes);
+    DoExpectIntEQ(wc_FreeRng(&rng), 0);
+#endif
+
+    /* GCM tag-failure output wipe: a corrupted tag with out non-NULL and
+     * sz > 0 wipes the unauthenticated plaintext (AES_GCM_AUTH_E). */
+#if defined(HAVE_AESGCM) && \
+    (defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT))
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_AesGcmSetKey(&aes, key16, sizeof(key16)), 0);
+    ExpectIntEQ(wc_AesGcmEncrypt(&aes, out, in, sizeof(in), iv,
+        sizeof(iv), tag, sizeof(tag), NULL, 0), 0);
+    tag[0] ^= 0x01;
+    ExpectIntEQ(wc_AesGcmDecrypt(&aes, out, out, sizeof(in), iv,
+        sizeof(iv), tag, sizeof(tag), NULL, 0),
+        WC_NO_ERR_TRACE(AES_GCM_AUTH_E));
+    wc_AesFree(&aes);
+#endif
+
+    /* CFB leftover-drain loop: a partial decrypt leaves aes->left, an empty
+     * request evaluates the loop with sz == 0, and a call longer than the
+     * leftover exits with left == 0 while sz is still positive. */
+#if defined(WOLFSSL_AES_CFB) && defined(HAVE_AES_DECRYPT)
+    ExpectIntEQ(wc_AesInit(&aes, NULL, INVALID_DEVID), 0);
+    /* CFB always uses the forward cipher for both directions. */
+    ExpectIntEQ(wc_AesSetKey(&aes, key16, sizeof(key16), iv, AES_ENCRYPTION),
+        0);
+    ExpectIntEQ(wc_AesSetIV(&aes, iv), 0);
+    ExpectIntEQ(wc_AesCfbDecrypt(&aes, out, in, 5), 0);
+    ExpectIntEQ(wc_AesCfbDecrypt(&aes, out, in, 0), 0);
+    ExpectIntEQ(wc_AesCfbDecrypt(&aes, out, in, 3), 0);
+    ExpectIntEQ(wc_AesCfbDecrypt(&aes, out, in, 10), 0);
+    wc_AesFree(&aes);
+#endif
+#endif /* !NO_AES && !HAVE_SELFTEST && !HAVE_FIPS */
+    return EXPECT_RESULT();
+}

tests/api/test_aes.h

@@ -118,6 +118,7 @@ int test_wc_AesGcm_MonteCarlo(void);
 int test_wc_AesCcm_MonteCarlo(void);
 int test_wc_AesCfb_MonteCarlo(void);
 int test_wc_AesOfb_MonteCarlo(void);
+int test_wc_AesReworkDecisionCoverage(void);
 
 int test_wc_GmacSetKey(void);
 int test_wc_GmacUpdate(void);
@@ -206,6 +207,7 @@ int test_wc_CryptoCb_AesDirect(void);
 
 #define TEST_AES_DECLS                                          \
     TEST_DECL_GROUP("aes", test_wc_AesSetKey),                  \
+    TEST_DECL_GROUP("aes", test_wc_AesReworkDecisionCoverage),  \
     TEST_DECL_GROUP("aes", test_wc_AesSetIV),                   \
     TEST_DECL_GROUP("aes", test_wc_AesSetIV_RestartsStream),    \
     TEST_DECL_GROUP("aes", test_wc_AesEncryptDecryptDirect),    \

tests/api/test_asn.c

@@ -6854,3 +6854,51 @@ int test_SetCertificatePolicies_no_empty_qualifiers(void)
 #endif
     return EXPECT_RESULT();
 }
+
+/*
+ * MC/DC decision coverage for the PKCS#8 key-creation/encryption guards in
+ * wolfcrypt/src/asn.c: the LENGTH_ONLY_E size-query row of
+ * wc_CreatePKCS8Key, the GetAlgoV2-failure row of wc_EncryptPKCS8Key_ex,
+ * the undersized-buffer row, and the NULL-hmacOid PBES2 row. A raw key
+ * buffer is used (no cert-buffer dependency) so the rows run in every
+ * variant.
+ */
+int test_wc_Pkcs8EncryptDecisionCoverage(void)
+{
+    EXPECT_DECLS;
+#if defined(HAVE_PKCS8) && !defined(NO_PWDBASED) && \
+    defined(HAVE_AES_CBC) && !defined(NO_AES) && defined(WOLFSSL_AES_128) && \
+    defined(HAVE_ECC) && !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
+    WC_RNG rng;
+    byte   key[32];
+    byte   out[512];
+    byte   salt[8];
+    word32 outSz;
+
+    XMEMSET(key, 3, sizeof(key));
+    XMEMSET(salt, 4, sizeof(salt));
+    XMEMSET(&rng, 0, sizeof(rng));
+    ExpectIntEQ(wc_InitRng_ex(&rng, HEAP_HINT, INVALID_DEVID), 0);
+
+    /* The size query exercises the true side of the length-only check. */
+    outSz = sizeof(out);
+    ExpectIntEQ(wc_CreatePKCS8Key(NULL, &outSz, key, sizeof(key), RSAk,
+        NULL, 0), WC_NO_ERR_TRACE(LENGTH_ONLY_E));
+
+    /* wc_EncryptPKCS8Key_ex: a bogus PBES2 encAlgId fails GetAlgoV2, so
+     * the (ret == 0) operand of the encOid check takes its false side. */
+    outSz = sizeof(out);
+    ExpectIntEQ(wc_EncryptPKCS8Key_ex(key, sizeof(key), out, &outSz,
+        "pw", 2, PKCS5, PBES2, 0x7FFFFFFF, salt, sizeof(salt), 1000, 0,
+        &rng, HEAP_HINT), WC_NO_ERR_TRACE(ALGO_ID_E));
+
+    /* Invalid HMAC OID reaches the PBES2 OID check with a valid cipher. */
+    outSz = sizeof(out);
+    ExpectIntEQ(wc_EncryptPKCS8Key_ex(key, sizeof(key), out, &outSz,
+        "pw", 2, PKCS5, PBES2, AES128CBCb, salt, sizeof(salt), 1000,
+        0x7FFFFFFF, &rng, HEAP_HINT), WC_NO_ERR_TRACE(ALGO_ID_E));
+
+    ExpectIntEQ(wc_FreeRng(&rng), 0);
+#endif /* HAVE_AES_CBC && !NO_AES && WOLFSSL_AES_128 && !FIPS */
+    return EXPECT_RESULT();
+}

tests/api/test_asn.h

@@ -72,6 +72,7 @@ int test_wc_DecodeExtKeyUsage_ssh_oid_collision(void);
 int test_wc_DecodeExtKeyUsage_oidSumCollision(void);
 int test_wc_AsnDecisionCoverage(void);
 int test_wc_AsnFeatureCoverage(void);
+int test_wc_Pkcs8EncryptDecisionCoverage(void);
 int test_wc_AltNameNewEx(void);
 
 #define TEST_ASN_DECLS                                              \
@@ -123,6 +124,7 @@ int test_wc_AltNameNewEx(void);
     TEST_DECL_GROUP("asn", test_wc_DecodeExtKeyUsage_oidSumCollision), \
     TEST_DECL_GROUP("asn", test_wc_AsnDecisionCoverage),           \
     TEST_DECL_GROUP("asn", test_wc_AsnFeatureCoverage),             \
+    TEST_DECL_GROUP("asn", test_wc_Pkcs8EncryptDecisionCoverage),   \
     TEST_DECL_GROUP("asn", test_wc_AltNameNewEx)
 
 #endif /* WOLFCRYPT_TEST_ASN_H */