WolfSSL
/
wolfssljni
mirror of https://github.com/wolfSSL/wolfssljni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-9119: validate min key size range before narrowing to word16/short

pull/400/head
Chris Conlon 2026-08-14 10:32:49 -06:00
parent 154b52bc78
commit 3a2c837632
2 changed files with 42 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
native/com_wolfssl_WolfSSLContext.c
View File

@ -7088,11 +7088,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinDhKeySz
WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr;
(void)obj;
/* wolfSSL_CTX_SetMinDhKey_Sz() sanitizes ctx and keySzBits */
/* wolfSSL_CTX_SetMinDhKey_Sz() sanitizes ctx */
if (jenv == NULL) {
return (jint)BAD_FUNC_ARG;
}
/* Validate range before narrowing to word16, otherwise out of range
* value can wrap to a smaller key size */
if ((keySzBits < 0) || (keySzBits > (jint)WOLFSSL_MAX_16BIT)) {
return (jint)BAD_FUNC_ARG;
}
return (jint)wolfSSL_CTX_SetMinDhKey_Sz(ctx, (word16)keySzBits);
#else
(void)jenv;
@ -7110,11 +7116,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinRsaKeySz
WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr;
(void)obj;
/* wolfSSL_CTX_SetMinRsaKey_Sz() sanitizes ctx and keySzBits */
/* wolfSSL_CTX_SetMinRsaKey_Sz() sanitizes ctx */
if (jenv == NULL) {
return (jint)BAD_FUNC_ARG;
}
/* Validate range before narrowing to short, otherwise out of range value
* can wrap to a smaller key size */
if ((keySzBits < 0) || (keySzBits > INT16_MAX)) {
return (jint)BAD_FUNC_ARG;
}
return (jint)wolfSSL_CTX_SetMinRsaKey_Sz(ctx, (short)keySzBits);
#else
(void)jenv;
@ -7132,11 +7144,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinEccKeySz
WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr;
(void)obj;
/* wolfSSL_CTX_SetMinEccKey_Sz() sanitizes ctx and keySzBits */
/* wolfSSL_CTX_SetMinEccKey_Sz() sanitizes ctx */
if (jenv == NULL) {
return (jint)BAD_FUNC_ARG;
}
/* Validate range before narrowing to short, otherwise out of range value
* can wrap to a smaller key size */
if ((keySzBits < 0) || (keySzBits > INT16_MAX)) {
return (jint)BAD_FUNC_ARG;
}
return (jint)wolfSSL_CTX_SetMinEccKey_Sz(ctx, (short)keySzBits);
#else
(void)jenv;

21
src/test/com/wolfssl/test/WolfSSLContextTest.java
View File

@ -762,6 +762,13 @@ public class WolfSSLContextTest {
fail("setMinRSAKeySize should fail with negative key size");
}
/* value that wraps across the 16-bit boundary should fail,
* 66560 wraps to 1024. */
ret = ctx.setMinRSAKeySize(66560);
if (ret != WolfSSL.BAD_FUNC_ARG) {
fail("setMinRSAKeySize should fail for out-of-range value");
}
/* key length not % 8 should fail */
ret = ctx.setMinRSAKeySize(1023);
if (ret != WolfSSL.BAD_FUNC_ARG) {
@ -814,6 +821,13 @@ public class WolfSSLContextTest {
fail("setMinECCKeySize should fail with negative key size");
}
/* value that wraps across the 16-bit boundary should fail,
* 66048 narrows to 512. */
ret = ctx.setMinECCKeySize(66048);
if (ret != WolfSSL.BAD_FUNC_ARG) {
fail("setMinECCKeySize should fail for out-of-range value");
}
/* valid key length should succeed */
ret = ctx.setMinECCKeySize(128);
if (ret != WolfSSL.SSL_SUCCESS) {
@ -868,6 +882,13 @@ public class WolfSSLContextTest {
fail("setMinDHKeySize should fail with key size too large");
}
/* value that wraps across the 16-bit boundary should fail,
* 66560 narrows to 1024. */
ret = ctx.setMinDHKeySize(66560);
if (ret != WolfSSL.BAD_FUNC_ARG) {
fail("setMinDHKeySize should fail for out-of-range value");
}
/* key length not % 8 should fail */
ret = ctx.setMinDHKeySize(1023);
if (ret != WolfSSL.BAD_FUNC_ARG) {