From 0adab671e9e2466e5ebe8ffe263978b2c149cd48 Mon Sep 17 00:00:00 2001 From: Hideki Miyazaki Date: Wed, 9 Sep 2026 11:18:35 -0400 Subject: [PATCH] Cover the DES-CBC decrypt arm in the EVP_Cipher error test test_wolfSSL_EVP_Cipher_des_cbc_error only initialised the context with enc == 1, so it exercised the wc_Des_CbcEncrypt path in wolfSSL_EVP_Cipher and left the wc_Des_CbcDecrypt assignment untested. Reverting only the decrypt-side change kept the test green. Add a symmetric case initialised with enc == 0 that passes a length which is not a multiple of DES_BLOCK_SIZE and asserts EVP_Cipher returns a negative value, so both arms of the switch have error-propagation coverage. --- tests/api/test_evp_cipher.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tests/api/test_evp_cipher.c b/tests/api/test_evp_cipher.c index f61fc5111f..c3de8b18b2 100644 --- a/tests/api/test_evp_cipher.c +++ b/tests/api/test_evp_cipher.c @@ -2846,13 +2846,20 @@ int test_wolfSSL_EVP_Cipher_des_cbc_error(void) XMEMSET(out, 0, sizeof(out)); /* Not a multiple of DES_BLOCK_SIZE: the DES call fails and EVP_Cipher must - * report the failure, not a rounded byte count. */ + * report the failure, not a rounded byte count. Both the encrypt and the + * decrypt arm of the switch must propagate the error. */ ExpectNotNull(ctx = EVP_CIPHER_CTX_new()); ExpectIntEQ(EVP_CipherInit(ctx, EVP_des_cbc(), key, iv, 1), 1); ExpectIntLT(EVP_Cipher(ctx, out, in, 15), 0); EVP_CIPHER_CTX_free(ctx); ctx = NULL; + ExpectNotNull(ctx = EVP_CIPHER_CTX_new()); + ExpectIntEQ(EVP_CipherInit(ctx, EVP_des_cbc(), key, iv, 0), 1); + ExpectIntLT(EVP_Cipher(ctx, out, in, 15), 0); + EVP_CIPHER_CTX_free(ctx); + ctx = NULL; + /* A block-multiple length still succeeds and reports the full length. */ ExpectNotNull(ctx = EVP_CIPHER_CTX_new()); ExpectIntEQ(EVP_CipherInit(ctx, EVP_des_cbc(), key, iv, 1), 1);