From be051a8fccefed7bc05620209833b5d25bdbb397 Mon Sep 17 00:00:00 2001 From: Ruby Martin Date: Wed, 4 Nov 2026 10:35:11 -0700 Subject: [PATCH 1/2] F-10635: Add bounds check before word32 cast --- src/ssl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/ssl.c b/src/ssl.c index 3773badb1d9..9a16cc8dd1b 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -11377,7 +11377,8 @@ int wolfSSL_FIPS_drbg_generate(WOLFSSL_DRBG_CTX* ctx, unsigned char* out, size_t adinlen) { int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE); - if (ctx != NULL && ctx->rng != NULL) { + if (ctx != NULL && ctx->rng != NULL && + outlen <= (size_t)WC_MAX_UINT_OF(word32)) { ret = wc_RNG_GenerateBlock(ctx->rng, out, (word32)outlen); if (ret == 0) { ret = WOLFSSL_SUCCESS; From 9b8754510c8af13a26987fbd37e3297c7700787f Mon Sep 17 00:00:00 2001 From: Ruby Martin Date: Wed, 4 Nov 2026 15:47:52 -0700 Subject: [PATCH 2/2] F-10635: Add regression test for outlen narrowing to zero --- tests/api.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/api.c b/tests/api.c index bab9ba8e71f..4716eef595d 100644 --- a/tests/api.c +++ b/tests/api.c @@ -40393,6 +40393,14 @@ static int test_openssl_FIPS_drbg(void) WOLFSSL_SUCCESS); ExpectIntNE(XMEMCMP(data1, zeroData, dlen), 0); ExpectIntNE(XMEMCMP(data1, data2, dlen), 0); + if (sizeof(size_t) > sizeof(word32)) { + /* an outlen that narrows to 0 as a word32 must not report success + * while leaving data1 untouched. */ + XMEMSET(data1, 0, dlen); + ExpectIntNE(FIPS_drbg_generate(dctx, data1, (size_t)0xFFFFFFFFU + 1, + 0, NULL, 0), WOLFSSL_SUCCESS); + ExpectIntEQ(XMEMCMP(data1, zeroData, dlen), 0); + } ExpectIntEQ(FIPS_drbg_uninstantiate(dctx), WOLFSSL_SUCCESS); #ifndef HAVE_GLOBAL_RNG /* gets freed by wolfSSL_Cleanup() when HAVE_GLOBAL_RNG defined */