From d450a533edd468546efe88fc7f22a79edbdbf9f5 Mon Sep 17 00:00:00 2001
From: Aidan <aidan@wolfssl.com>
Date: Fri, 17 Apr 2026 14:20:38 -0700
Subject: [PATCH] F-2998 - https://fenrir.wolfssl.com/finding/2998 - Add unit
 test for wolfTPM2_NVStoreKey persistent handle range checks

---
 tests/unit_tests.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/tests/unit_tests.c b/tests/unit_tests.c
index f22abaa7..9efb207b 100644
--- a/tests/unit_tests.c
+++ b/tests/unit_tests.c
@@ -2778,6 +2778,53 @@ static void test_wolfTPM2_ImportEccPrivateKeySeed_ErrorPaths(void)
 }
 #endif /* HAVE_ECC */
 
+static void test_wolfTPM2_NVStoreKey_BoundaryChecks(void)
+{
+    int rc;
+    WOLFTPM2_DEV dev;
+    WOLFTPM2_KEY key;
+
+    rc = wolfTPM2_Init(&dev, TPM2_IoCb, NULL);
+    AssertIntEQ(rc, 0);
+
+    XMEMSET(&key, 0, sizeof(key));
+
+    /* Owner hierarchy: handle below PERSISTENT_FIRST must fail */
+    rc = wolfTPM2_NVStoreKey(&dev, TPM_RH_OWNER, &key,
+        PERSISTENT_FIRST - 1);
+    AssertIntEQ(rc, BAD_FUNC_ARG);
+
+    /* Owner hierarchy: handle above PERSISTENT_LAST must fail */
+    rc = wolfTPM2_NVStoreKey(&dev, TPM_RH_OWNER, &key,
+        PERSISTENT_LAST + 1);
+    AssertIntEQ(rc, BAD_FUNC_ARG);
+
+    /* Owner hierarchy: PERSISTENT_FIRST must NOT fail with BAD_FUNC_ARG */
+    key.handle.hndl = 0; /* ensure not already persistent */
+    rc = wolfTPM2_NVStoreKey(&dev, TPM_RH_OWNER, &key,
+        PERSISTENT_FIRST);
+    AssertIntNE(rc, BAD_FUNC_ARG);
+
+    /* Owner hierarchy: PERSISTENT_LAST must NOT fail with BAD_FUNC_ARG */
+    rc = wolfTPM2_NVStoreKey(&dev, TPM_RH_OWNER, &key,
+        PERSISTENT_LAST);
+    AssertIntNE(rc, BAD_FUNC_ARG);
+
+    /* Platform hierarchy: handle below PLATFORM_PERSISTENT must fail */
+    rc = wolfTPM2_NVStoreKey(&dev, TPM_RH_PLATFORM, &key,
+        PLATFORM_PERSISTENT - 1);
+    AssertIntEQ(rc, BAD_FUNC_ARG);
+
+    /* Platform hierarchy: PLATFORM_PERSISTENT must NOT fail with BAD_FUNC_ARG */
+    rc = wolfTPM2_NVStoreKey(&dev, TPM_RH_PLATFORM, &key,
+        PLATFORM_PERSISTENT);
+    AssertIntNE(rc, BAD_FUNC_ARG);
+
+    wolfTPM2_Cleanup(&dev);
+
+    printf("Test TPM Wrapper:\tNVStoreKey boundary checks:\tPassed\n");
+}
+
 #endif /* !WOLFTPM2_NO_WRAPPER */
 
 #ifndef NO_MAIN_DRIVER
@@ -2844,6 +2891,7 @@ int unit_tests(int argc, char *argv[])
     #ifdef HAVE_ECC
     test_wolfTPM2_ImportEccPrivateKeySeed_ErrorPaths();
     #endif
+    test_wolfTPM2_NVStoreKey_BoundaryChecks();
     test_wolfTPM2_KeyBlob(TPM_ALG_RSA);
     test_wolfTPM2_KeyBlob(TPM_ALG_ECC);
     #if !defined(WOLFTPM2_NO_WOLFCRYPT) && defined(HAVE_ECC) && \