From e59b42b2ca40b07f28152a765d1187967fee7dc2 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Wed, 12 Aug 2026 16:57:15 -0700
Subject: [PATCH] Add documentation for expected size for DES functions. A
 complete fix is not possible without breaking OpenSSL compatibility. Fixes
 F-2246.

---
 src/ssl_crypto.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/ssl_crypto.c b/src/ssl_crypto.c
index 0e055a5a51..d5533e475c 100644
--- a/src/ssl_crypto.c
+++ b/src/ssl_crypto.c
@@ -2672,6 +2672,12 @@ WOLFSSL_DES_LONG wolfSSL_DES_cbc_cksum(const unsigned char* in,
  *       we are padding the last block. This is not a padding API.
  * TODO: Validate parameters?
  *
+ * A length that is not a multiple of DES_BLOCK_SIZE is rounded up to a whole
+ * block: on encrypt the trailing partial block is 0 padded and a full block is
+ * written to output, and on decrypt a full block is read from input. Both
+ * buffers must therefore hold length rounded up to DES_BLOCK_SIZE, not just
+ * length bytes.
+ *
  * @param [in]  input     Data to encipher.
  * @param [out] output    Enciphered data.
  * @param [in]  length    Length of data to encipher.
@@ -2740,6 +2746,10 @@ void wolfSSL_DES_cbc_encrypt(const unsigned char* input, unsigned char* output,
  *       we are padding the last block. This is not a padding API.
  * TODO: Validate parameters?
  *
+ * A length that is not a multiple of DES_BLOCK_SIZE is rounded up to a whole
+ * block, and the new IV is taken from that last whole block. Both buffers must
+ * therefore hold length rounded up to DES_BLOCK_SIZE, not just length bytes.
+ *
  * @param [in]      input     Data to encipher.
  * @param [out]     output    Enciphered data.
  * @param [in]      length    Length of data to encipher.
@@ -2792,6 +2802,12 @@ void wolfSSL_DES_ncbc_encrypt(const unsigned char* input, unsigned char* output,
  *       we are padding the last block. This is not a padding API.
  * TODO: Validate parameters?
  *
+ * A size that is not a multiple of DES_BLOCK_SIZE is rounded up to a whole
+ * block: on encrypt the trailing partial block is 0 padded and a full block is
+ * written to output, and on decrypt a full block is read from input. Both
+ * buffers must therefore hold sz rounded up to DES_BLOCK_SIZE, not just sz
+ * bytes.
+ *
  * @param [in]      input     Data to encipher.
  * @param [out]     output    Enciphered data.
  * @param [in]      length    Length of data to encipher.