WolfSSL
/
wolfcrypt-jni
mirror of https://github.com/wolfSSL/wolfcrypt-jni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-9999: validate backing buffer sizes in FIPS JNI wrappers

Chris Conlon 2026-09-02 10:25:08 -06:00
parent fc90b31e40
commit 00a57804bd
13 changed files with 1247 additions and 388 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1195
jni/jni_fips.c
View File

File diff suppressed because it is too large Load Diff

5
src/main/java/com/wolfssl/wolfcrypt/Fips.java
View File

@ -26,6 +26,11 @@ import java.nio.ByteBuffer;
/**
* Thin JNI wrapper for the native WolfCrypt FIPS 140-2/3 specific APIs.
*
* Every buffer argument must be backed by at least the number of bytes given
* by its size argument, or by the fixed size the operation requires (block
* size, digest size). Undersized buffers and negative sizes are rejected with
* BAD_FUNC_ARG before the native call.
*
* -----------------------------------------------------------------------------
* THREADING / SYNCHRONIZATION NOTE:
* -----------------------------------------------------------------------------

75
src/test/java/com/wolfssl/wolfcrypt/test/fips/AesFipsTest.java
View File

@ -25,6 +25,7 @@ import static org.junit.Assert.*;
import java.nio.ByteBuffer;
import org.junit.Assume;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.Rule;
@ -33,7 +34,9 @@ import org.junit.rules.TestWatcher;
import org.junit.runner.Description;
import com.wolfssl.wolfcrypt.Aes;
import com.wolfssl.wolfcrypt.FeatureDetect;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -49,6 +52,8 @@ public class AesFipsTest extends FipsTest {
private ByteBuffer aad = ByteBuffer.allocateDirect(Aes.BLOCK_SIZE);
private ByteBuffer tag = ByteBuffer.allocateDirect(Aes.BLOCK_SIZE);
private ByteBuffer expected = ByteBuffer.allocateDirect(Aes.BLOCK_SIZE);
private static final int BAD_FUNC_ARG =
WolfCryptError.BAD_FUNC_ARG.getCode();
@Rule(order = Integer.MIN_VALUE)
public TestRule testWatcher = TimedTestWatcher.create();
@ -58,6 +63,11 @@ public class AesFipsTest extends FipsTest {
System.out.println("JNI FIPS AES Tests");
}
private static void assumeAesGcm() {
Assume.assumeTrue("AES-GCM not compiled in",
FeatureDetect.AesGcmEnabled());
}
@Test
public void setKeyShouldReturnZeroUsingByteBuffer() {
key.put(Util.h2b("00112233445566778899aabbccddeeff")).rewind();
@ -104,6 +114,69 @@ public class AesFipsTest extends FipsTest {
Util.h2b("00112233445566778899aabbccddeeff")));
}
@Test
public void setKeyShouldRejectUndersizedKeyUsingByteArray() {
/* keylen claims 16 bytes but the array is only 1 byte */
assertEquals(BAD_FUNC_ARG, Fips.AesSetKey_fips(new Aes(),
new byte[1], Aes.KEY_SIZE_128, new byte[Aes.BLOCK_SIZE],
Aes.ENCRYPT_MODE));
}
@Test
public void setKeyShouldRejectUndersizedKeyUsingByteBuffer() {
ByteBuffer smallKey = ByteBuffer.allocateDirect(1);
assertEquals(BAD_FUNC_ARG, Fips.AesSetKey_fips(new Aes(), smallKey,
Aes.KEY_SIZE_128, iv, Aes.ENCRYPT_MODE));
}
@Test
public void cbcEncryptShouldRejectUndersizedBuffersUsingByteArray() {
/* size claims a full block but out/in are only 1 byte each */
assertEquals(BAD_FUNC_ARG, Fips.AesCbcEncrypt_fips(new Aes(),
new byte[1], new byte[1], Aes.BLOCK_SIZE));
}
@Test
public void cbcEncryptShouldRejectNegativeSizeUsingByteArray() {
assertEquals(BAD_FUNC_ARG, Fips.AesCbcEncrypt_fips(new Aes(),
new byte[Aes.BLOCK_SIZE], new byte[Aes.BLOCK_SIZE], -1));
}
@Test
public void cbcEncryptShouldRejectUndersizedBuffersUsingByteBuffer() {
ByteBuffer smallOut = ByteBuffer.allocateDirect(1);
ByteBuffer smallIn = ByteBuffer.allocateDirect(1);
assertEquals(BAD_FUNC_ARG, Fips.AesCbcEncrypt_fips(new Aes(),
smallOut, smallIn, Aes.BLOCK_SIZE));
}
@Test
public void gcmEncryptShouldRejectUndersizedAuthInUsingByteArray() {
assumeAesGcm();
/* authInSz claims a full block but authIn is only 1 byte */
assertEquals(BAD_FUNC_ARG, Fips.AesGcmEncrypt_fips(new Aes(),
new byte[Aes.BLOCK_SIZE], new byte[Aes.BLOCK_SIZE],
Aes.BLOCK_SIZE, new byte[12], 12, new byte[Aes.BLOCK_SIZE],
Aes.BLOCK_SIZE, new byte[1], Aes.BLOCK_SIZE));
}
@Test
public void gcmEncryptShouldRejectNullAuthTagWithSizeUsingByteBuffer() {
assumeAesGcm();
assertEquals(BAD_FUNC_ARG, Fips.AesGcmEncrypt_fips(new Aes(),
output, input, Aes.BLOCK_SIZE, iv, 12, null, Aes.BLOCK_SIZE,
aad, Aes.BLOCK_SIZE));
}
@Test
public void gcmDecryptShouldRejectUndersizedBuffersUsingByteArray() {
assumeAesGcm();
/* size claims a full block but out/in are only 1 byte each */
assertEquals(BAD_FUNC_ARG, Fips.AesGcmDecrypt_fips(new Aes(),
new byte[1], new byte[1], Aes.BLOCK_SIZE, new byte[12], 12,
new byte[Aes.BLOCK_SIZE], Aes.BLOCK_SIZE, null, 0));
}
@Test
public void cbcEncryptDecryptShouldMatchUsingByteByffer() {
String[] keys = new String[] {
@ -368,6 +441,7 @@ public class AesFipsTest extends FipsTest {
@Test
public void gcmEncrypShouldMatchUsingByteByffer() {
assumeAesGcm();
String[] keys = new String[] {
"96f309d0f15ba970e114a9216e75a14f89e28948ce7d98bd37f0beefe36803b0",
"3872431f89eba694cbc9b12d10d11b707a4248e7ff90a4bbcd271df7ff33c3a8",
@ -506,6 +580,7 @@ public class AesFipsTest extends FipsTest {
@Test
public void gcmEncrypShouldMatchUsingByteArray() {
assumeAesGcm();
String[] keys = new String[] {
"96f309d0f15ba970e114a9216e75a14f89e28948ce7d98bd37f0beefe36803b0",
"3872431f89eba694cbc9b12d10d11b707a4248e7ff90a4bbcd271df7ff33c3a8",

25
src/test/java/com/wolfssl/wolfcrypt/test/fips/Des3FipsTest.java
View File

@ -192,4 +192,29 @@ public class Des3FipsTest extends FipsTest {
assertArrayEquals(plain, vector);
}
}
@Test
public void setKeyShouldRejectUndersizedKeyUsingByteArray() {
/* key must be Des3.KEY_SIZE bytes but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.Des3_SetKey_fips(new Des3(), new byte[1], null,
Des3.ENCRYPT_MODE));
}
@Test
public void cbcDecryptShouldRejectUndersizedBuffersUsingByteArray() {
/* size claims a full block but out/in are only 1 byte each */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.Des3_CbcDecrypt_fips(new Des3(), new byte[1], new byte[1],
Des3.BLOCK_SIZE));
}
@Test
public void setKeyShouldRejectUndersizedKeyUsingByteBuffer() {
ByteBuffer smallKey = ByteBuffer.allocateDirect(1);
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.Des3_SetKey_fips(new Des3(), smallKey, null,
Des3.ENCRYPT_MODE));
}
}

80
src/test/java/com/wolfssl/wolfcrypt/test/fips/DhFipsTest.java
View File

@ -38,6 +38,7 @@ import com.wolfssl.wolfcrypt.Dh;
import com.wolfssl.wolfcrypt.FeatureDetect;
import com.wolfssl.wolfcrypt.Rng;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -286,4 +287,83 @@ public class DhFipsTest extends FipsTest {
Fips.FreeDhKey(key);
}
@Test
public void agreeShouldRejectUndersizedPrivUsingByteArray() {
Dh key = new Dh();
long[] agreeSz = { 256 };
Fips.InitDhKey(key);
/* privSz claims 256 bytes but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.DhAgree(key, new byte[256], agreeSz, new byte[1], 256,
new byte[256], 256));
Fips.FreeDhKey(key);
}
@Test
public void generateKeyPairShouldRejectOversizedPrivSzUsingByteArray() {
Dh key = new Dh();
Rng rng = new Rng();
/* privSz claims 257 bytes but priv is only 256 bytes */
long[] privSz = { 257 };
long[] pubSz = { 256 };
Fips.InitDhKey(key);
assertEquals(WolfCrypt.SUCCESS, Fips.InitRng_fips(rng));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.DhGenerateKeyPair(key, rng, new byte[256], privSz,
new byte[256], pubSz));
Fips.FreeDhKey(key);
Fips.FreeRng_fips(rng);
}
@Test
public void agreeShouldRejectOversizedAgreeSzUsingByteArray() {
Dh key = new Dh();
/* agreeSz claims 257 bytes but agree is only 256 bytes */
long[] agreeSz = { 257 };
Fips.InitDhKey(key);
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.DhAgree(key, new byte[256], agreeSz, new byte[256], 256,
new byte[256], 256));
Fips.FreeDhKey(key);
}
@Test
public void agreeShouldRejectOversizedAgreeSzUsingByteBuffer() {
Dh key = new Dh();
ByteBuffer agree = ByteBuffer.allocateDirect(256);
ByteBuffer priv = ByteBuffer.allocateDirect(256);
ByteBuffer pub = ByteBuffer.allocateDirect(256);
/* agreeSz claims 257 bytes but agree is only 256 bytes */
long[] agreeSz = { 257 };
Fips.InitDhKey(key);
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.DhAgree(key, agree, agreeSz, priv, 256, pub, 256));
Fips.FreeDhKey(key);
}
@Test
public void paramsLoadShouldRejectOversizedPSzUsingByteBuffer() {
ByteBuffer input = ByteBuffer.allocateDirect(16);
ByteBuffer p = ByteBuffer.allocateDirect(16);
ByteBuffer g = ByteBuffer.allocateDirect(16);
/* pInOutSz claims 17 bytes but p is only 16 bytes */
long[] pSz = { 17 };
long[] gSz = { 16 };
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.DhParamsLoad(input, 16, p, pSz, g, gSz));
}
}

77
src/test/java/com/wolfssl/wolfcrypt/test/fips/EccFipsTest.java
View File

@ -263,4 +263,81 @@ public class EccFipsTest extends FipsTest {
Fips.ecc_free(alice);
Fips.FreeRng_fips(rng);
}
@Test
public void importX963ShouldRejectUndersizedInputUsingByteArray() {
Ecc key = new Ecc();
assertEquals(WolfCrypt.SUCCESS, Fips.ecc_init(key));
/* inLen claims 65 bytes but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ecc_import_x963(new byte[1], 65, key));
Fips.ecc_free(key);
}
@Test
public void sharedSecretShouldRejectOversizedOutLenUsingByteArray() {
Ecc alice = new Ecc();
Ecc bob = new Ecc();
/* outLen claims 65 bytes but out is only 64 bytes */
long[] outLen = { 65 };
assertEquals(WolfCrypt.SUCCESS, Fips.ecc_init(alice));
assertEquals(WolfCrypt.SUCCESS, Fips.ecc_init(bob));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ecc_shared_secret(alice, bob, new byte[64], outLen));
Fips.ecc_free(alice);
Fips.ecc_free(bob);
}
@Test
public void exportX963ShouldRejectOversizedOutLenUsingByteArray() {
Ecc key = new Ecc();
/* outLen claims 65 bytes but out is only 64 bytes */
long[] outLen = { 65 };
assertEquals(WolfCrypt.SUCCESS, Fips.ecc_init(key));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ecc_export_x963(key, new byte[64], outLen));
Fips.ecc_free(key);
}
@Test
public void sharedSecretShouldRejectOversizedOutLenUsingByteBuffer() {
Ecc alice = new Ecc();
Ecc bob = new Ecc();
ByteBuffer out = ByteBuffer.allocateDirect(64);
/* outLen claims 65 bytes but out is only 64 bytes */
long[] outLen = { 65 };
assertEquals(WolfCrypt.SUCCESS, Fips.ecc_init(alice));
assertEquals(WolfCrypt.SUCCESS, Fips.ecc_init(bob));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ecc_shared_secret(alice, bob, out, outLen));
Fips.ecc_free(alice);
Fips.ecc_free(bob);
}
@Test
public void exportX963ShouldRejectOversizedOutLenUsingByteBuffer() {
Ecc key = new Ecc();
ByteBuffer out = ByteBuffer.allocateDirect(64);
/* outLen claims 65 bytes but out is only 64 bytes */
long[] outLen = { 65 };
assertEquals(WolfCrypt.SUCCESS, Fips.ecc_init(key));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ecc_export_x963(key, out, outLen));
Fips.ecc_free(key);
}
}

27
src/test/java/com/wolfssl/wolfcrypt/test/fips/HmacFipsTest.java
View File

@ -38,6 +38,7 @@ import com.wolfssl.wolfcrypt.Sha256;
import com.wolfssl.wolfcrypt.Sha384;
import com.wolfssl.wolfcrypt.Sha512;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -372,4 +373,30 @@ public class HmacFipsTest extends FipsTest {
assertArrayEquals(expected, result);
}
}
@Test
public void updateShouldRejectUndersizedDataUsingByteArray() {
/* len claims 16 bytes but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.HmacUpdate_fips(new Hmac(), new byte[1], 16));
}
@Test
public void finalShouldRejectUndersizedHashUsingByteArray() {
Hmac hmac = new Hmac();
assertEquals(WolfCrypt.SUCCESS, Fips.HmacSetKey_fips(hmac,
Hmac.SHA256, new byte[32], 32));
/* hash must hold a SHA-256 digest but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.HmacFinal_fips(hmac, new byte[1]));
}
@Test
public void updateShouldRejectUndersizedDataUsingByteBuffer() {
ByteBuffer smallData = ByteBuffer.allocateDirect(1);
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.HmacUpdate_fips(new Hmac(), smallData, 16));
}
}

52
src/test/java/com/wolfssl/wolfcrypt/test/fips/RngFipsTest.java
View File

@ -34,6 +34,7 @@ import org.junit.runner.Description;
import com.wolfssl.wolfcrypt.Rng;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -123,4 +124,55 @@ public class RngFipsTest extends FipsTest {
inputB[i].length() / 2, expected, result[i].length() / 2));
}
}
@Test
public void healthTestShouldRejectUndersizedOutputUsingByteArray() {
/* outputSz claims 256 bytes but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.RNG_HealthTest_fips(0, new byte[48], 48, null, 0,
new byte[1], 256));
}
@Test
public void healthTestShouldRejectUndersizedEntropyBUsingByteArray() {
/* with reseed set, entropyB must hold entropyBSz bytes */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.RNG_HealthTest_fips(1, new byte[48], 48, new byte[1], 32,
new byte[256], 256));
}
@Test
public void healthTestShouldRejectUndersizedOutputUsingByteBuffer() {
ByteBuffer entropyA = ByteBuffer.allocateDirect(48);
ByteBuffer output = ByteBuffer.allocateDirect(1);
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.RNG_HealthTest_fips(0, entropyA, 48, null, 0, output, 256));
}
@Test
public void generateBlockShouldRejectUndersizedBufferUsingByteArray() {
Rng rng = new Rng();
assertEquals(WolfCrypt.SUCCESS, Fips.InitRng_fips(rng));
/* bufSz claims 256 bytes but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.RNG_GenerateBlock_fips(rng, new byte[1], 256));
Fips.FreeRng_fips(rng);
}
@Test
public void generateBlockShouldRejectNegativeSizeUsingByteBuffer() {
Rng rng = new Rng();
ByteBuffer buf = ByteBuffer.allocateDirect(32);
assertEquals(WolfCrypt.SUCCESS, Fips.InitRng_fips(rng));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.RNG_GenerateBlock_fips(rng, buf, -1));
Fips.FreeRng_fips(rng);
}
}

34
src/test/java/com/wolfssl/wolfcrypt/test/fips/RsaFipsTest.java
View File

@ -37,6 +37,7 @@ import com.wolfssl.wolfcrypt.Rsa;
import com.wolfssl.wolfcrypt.Rng;
import com.wolfssl.wolfcrypt.Sha256;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -648,4 +649,37 @@ public class RsaFipsTest extends FipsTest {
Fips.FreeRsaKey_fips(rsa);
Fips.FreeRng_fips(rng);
}
@Test
public void sslSignShouldRejectNegativeOutLenUsingByteArray() {
Rsa rsa = new Rsa();
Rng rng = new Rng();
assertEquals(WolfCrypt.SUCCESS, Fips.InitRsaKey_fips(rsa, null));
assertEquals(WolfCrypt.SUCCESS, Fips.InitRng_fips(rng));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.RsaSSL_Sign_fips(new byte[32], 32, new byte[256], -1,
rsa, rng));
Fips.FreeRsaKey_fips(rsa);
Fips.FreeRng_fips(rng);
}
@Test
public void sslSignShouldRejectNegativeOutLenUsingByteBuffer() {
Rsa rsa = new Rsa();
Rng rng = new Rng();
ByteBuffer in = ByteBuffer.allocateDirect(32);
ByteBuffer out = ByteBuffer.allocateDirect(256);
assertEquals(WolfCrypt.SUCCESS, Fips.InitRsaKey_fips(rsa, null));
assertEquals(WolfCrypt.SUCCESS, Fips.InitRng_fips(rng));
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.RsaSSL_Sign_fips(in, 32, out, -1, rsa, rng));
Fips.FreeRsaKey_fips(rsa);
Fips.FreeRng_fips(rng);
}
}

8
src/test/java/com/wolfssl/wolfcrypt/test/fips/Sha256FipsTest.java
View File

@ -34,6 +34,7 @@ import org.junit.runner.Description;
import com.wolfssl.wolfcrypt.Sha256;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -117,4 +118,11 @@ public class Sha256FipsTest extends FipsTest {
assertArrayEquals(expected, result);
}
}
@Test
public void finalShouldRejectUndersizedHashUsingByteArray() {
/* hash must hold the digest but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.Sha256Final_fips(new Sha256(), new byte[1]));
}
}

27
src/test/java/com/wolfssl/wolfcrypt/test/fips/Sha384FipsTest.java
View File

@ -25,15 +25,19 @@ import static org.junit.Assert.*;
import java.nio.ByteBuffer;
import org.junit.Assume;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.Rule;
import org.junit.rules.TestRule;
import org.junit.rules.TestWatcher;
import org.junit.runner.Description;
import org.junit.runners.model.Statement;
import com.wolfssl.wolfcrypt.FeatureDetect;
import com.wolfssl.wolfcrypt.Sha384;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -47,6 +51,22 @@ public class Sha384FipsTest extends FipsTest {
@Rule(order = Integer.MIN_VALUE)
public TestRule testWatcher = TimedTestWatcher.create();
/* Rule to skip tests when native wolfSSL is built without SHA-384 */
@Rule(order = Integer.MIN_VALUE + 3)
public TestRule sha384Available = new TestRule() {
@Override
public Statement apply(final Statement base, Description description) {
return new Statement() {
@Override
public void evaluate() throws Throwable {
Assume.assumeTrue("SHA-384 not compiled in native wolfSSL",
FeatureDetect.Sha384Enabled());
base.evaluate();
}
};
}
};
@BeforeClass
public static void setupClass() {
System.out.println("JNI FIPS SHA2-384 Tests");
@ -127,4 +147,11 @@ public class Sha384FipsTest extends FipsTest {
assertArrayEquals(expected, result);
}
}
@Test
public void finalShouldRejectUndersizedHashUsingByteArray() {
/* hash must hold the digest but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.Sha384Final_fips(new Sha384(), new byte[1]));
}
}

8
src/test/java/com/wolfssl/wolfcrypt/test/fips/Sha512FipsTest.java
View File

@ -34,6 +34,7 @@ import org.junit.runner.Description;
import com.wolfssl.wolfcrypt.Sha512;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -127,4 +128,11 @@ public class Sha512FipsTest extends FipsTest {
assertArrayEquals(expected, result);
}
}
@Test
public void finalShouldRejectUndersizedHashUsingByteArray() {
/* hash must hold the digest but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.Sha512Final_fips(new Sha512(), new byte[1]));
}
}

22
src/test/java/com/wolfssl/wolfcrypt/test/fips/ShaFipsTest.java
View File

@ -34,6 +34,7 @@ import org.junit.runner.Description;
import com.wolfssl.wolfcrypt.Sha;
import com.wolfssl.wolfcrypt.WolfCrypt;
import com.wolfssl.wolfcrypt.WolfCryptError;
import com.wolfssl.wolfcrypt.Fips;
import com.wolfssl.wolfcrypt.test.Util;
@ -117,4 +118,25 @@ public class ShaFipsTest extends FipsTest {
assertArrayEquals(expected, result);
}
}
@Test
public void updateShouldRejectNegativeLenUsingByteArray() {
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ShaUpdate_fips(new Sha(), new byte[Sha.DIGEST_SIZE], -1));
}
@Test
public void finalShouldRejectUndersizedHashUsingByteArray() {
/* hash must hold Sha.DIGEST_SIZE bytes but the array is only 1 byte */
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ShaFinal_fips(new Sha(), new byte[1]));
}
@Test
public void finalShouldRejectUndersizedHashUsingByteBuffer() {
ByteBuffer smallHash = ByteBuffer.allocateDirect(1);
assertEquals(WolfCryptError.BAD_FUNC_ARG.getCode(),
Fips.ShaFinal_fips(new Sha(), smallHash));
}
}