WolfSSL
/
wolfcrypt-jni
mirror of https://github.com/wolfSSL/wolfcrypt-jni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-5037: reject negative key length in PKCS12 PBKDF JNI wrapper

pull/262/head
Chris Conlon 2026-08-19 14:37:08 -06:00
parent de66edb920
commit 82503a3060
2 changed files with 50 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
jni/jni_pwdbased.c
View File

@ -52,7 +52,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PKCS12_1PBK
jbyteArray result = NULL;
(void)jcl;
if (env == NULL || kLen == 0) {
if (env == NULL || kLen <= 0) {
throwWolfCryptExceptionFromError(env, BAD_FUNC_ARG);
return NULL;
}
@ -147,7 +147,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PBKDF2
jbyteArray result = NULL;
(void)jcl;
if (env == NULL || kLen == 0) {
if (env == NULL || kLen <= 0) {
throwWolfCryptExceptionFromError(env, BAD_FUNC_ARG);
return NULL;
}

48
src/test/java/com/wolfssl/wolfcrypt/test/PwdbasedTest.java
View File

@ -134,4 +134,52 @@ public class PwdbasedTest {
assertArrayEquals("PKCS12_PBKDF modified caller password array",
passCopy, pass);
}
/**
* PBKDF2 must reject zero/negative key lengths with BAD_FUNC_ARG.
*/
@Test
public void testPbkdf2RejectsNonPositiveKeyLength() {
Assume.assumeTrue("PBKDF2 not compiled in native wolfSSL",
FeatureDetect.Pbkdf2Enabled());
byte[] pass = makePassword();
byte[] salt = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
for (int kLen : new int[] {-1, 0}) {
try {
Pwdbased.PBKDF2(pass, salt, 100, kLen,
WolfCrypt.WC_HASH_TYPE_SHA256);
fail("PBKDF2 should reject kLen: " + kLen);
} catch (WolfCryptException e) {
assertEquals("kLen " + kLen + " must map to BAD_FUNC_ARG",
WolfCryptError.BAD_FUNC_ARG, e.getError());
}
}
}
/**
* PKCS12 PBKDF must reject zero/negative key lengths with BAD_FUNC_ARG.
*/
@Test
public void testPkcs12PbkdfRejectsNonPositiveKeyLength() {
byte[] pass = makePassword();
byte[] salt = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
for (int kLen : new int[] {-1, 0}) {
try {
Pwdbased.PKCS12_PBKDF(pass, salt, 100, kLen,
WolfCrypt.WC_HASH_TYPE_SHA256, 1);
fail("PKCS12_PBKDF should reject kLen: " + kLen);
} catch (WolfCryptException e) {
Assume.assumeTrue(
"PKCS12 PBKDF not compiled in native wolfSSL",
e.getError() != WolfCryptError.NOT_COMPILED_IN);
assertEquals("kLen " + kLen + " must map to BAD_FUNC_ARG",
WolfCryptError.BAD_FUNC_ARG, e.getError());
}
}
}
}