From 82503a30602d9fc407afb6d08a4f15e46cfcd25d Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Wed, 19 Aug 2026 14:37:08 -0600
Subject: [PATCH] F-5037: reject negative key length in PKCS12 PBKDF JNI
 wrapper

---
 jni/jni_pwdbased.c                            |  4 +-
 .../wolfssl/wolfcrypt/test/PwdbasedTest.java  | 48 +++++++++++++++++++
 2 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/jni/jni_pwdbased.c b/jni/jni_pwdbased.c
index 3a5a0c66..12939400 100644
--- a/jni/jni_pwdbased.c
+++ b/jni/jni_pwdbased.c
@@ -52,7 +52,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PKCS12_1PBK
     jbyteArray result = NULL;
     (void)jcl;
 
-    if (env == NULL || kLen == 0) {
+    if (env == NULL || kLen <= 0) {
         throwWolfCryptExceptionFromError(env, BAD_FUNC_ARG);
         return NULL;
     }
@@ -147,7 +147,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PBKDF2
     jbyteArray result = NULL;
     (void)jcl;
 
-    if (env == NULL || kLen == 0) {
+    if (env == NULL || kLen <= 0) {
         throwWolfCryptExceptionFromError(env, BAD_FUNC_ARG);
         return NULL;
     }
diff --git a/src/test/java/com/wolfssl/wolfcrypt/test/PwdbasedTest.java b/src/test/java/com/wolfssl/wolfcrypt/test/PwdbasedTest.java
index 14b11591..97599e8f 100644
--- a/src/test/java/com/wolfssl/wolfcrypt/test/PwdbasedTest.java
+++ b/src/test/java/com/wolfssl/wolfcrypt/test/PwdbasedTest.java
@@ -134,4 +134,52 @@ public class PwdbasedTest {
         assertArrayEquals("PKCS12_PBKDF modified caller password array",
             passCopy, pass);
     }
+
+    /**
+     * PBKDF2 must reject zero/negative key lengths with BAD_FUNC_ARG.
+     */
+    @Test
+    public void testPbkdf2RejectsNonPositiveKeyLength() {
+
+        Assume.assumeTrue("PBKDF2 not compiled in native wolfSSL",
+            FeatureDetect.Pbkdf2Enabled());
+
+        byte[] pass = makePassword();
+        byte[] salt = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
+
+        for (int kLen : new int[] {-1, 0}) {
+            try {
+                Pwdbased.PBKDF2(pass, salt, 100, kLen,
+                    WolfCrypt.WC_HASH_TYPE_SHA256);
+                fail("PBKDF2 should reject kLen: " + kLen);
+            } catch (WolfCryptException e) {
+                assertEquals("kLen " + kLen + " must map to BAD_FUNC_ARG",
+                    WolfCryptError.BAD_FUNC_ARG, e.getError());
+            }
+        }
+    }
+
+    /**
+     * PKCS12 PBKDF must reject zero/negative key lengths with BAD_FUNC_ARG.
+     */
+    @Test
+    public void testPkcs12PbkdfRejectsNonPositiveKeyLength() {
+
+        byte[] pass = makePassword();
+        byte[] salt = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
+
+        for (int kLen : new int[] {-1, 0}) {
+            try {
+                Pwdbased.PKCS12_PBKDF(pass, salt, 100, kLen,
+                    WolfCrypt.WC_HASH_TYPE_SHA256, 1);
+                fail("PKCS12_PBKDF should reject kLen: " + kLen);
+            } catch (WolfCryptException e) {
+                Assume.assumeTrue(
+                    "PKCS12 PBKDF not compiled in native wolfSSL",
+                    e.getError() != WolfCryptError.NOT_COMPILED_IN);
+                assertEquals("kLen " + kLen + " must map to BAD_FUNC_ARG",
+                    WolfCryptError.BAD_FUNC_ARG, e.getError());
+            }
+        }
+    }
 }