From e5b065fc07e0679805891f372831e2c3fd314b74 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:04:25 -0600 Subject: [PATCH 01/10] F-6548: create the trimmed SAN array with the Object[][] element class --- native/com_wolfssl_WolfSSLCertificate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/native/com_wolfssl_WolfSSLCertificate.c b/native/com_wolfssl_WolfSSLCertificate.c index e2261b6..eb58302 100644 --- a/native/com_wolfssl_WolfSSLCertificate.c +++ b/native/com_wolfssl_WolfSSLCertificate.c @@ -2886,7 +2886,7 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1su /* If we got fewer entries than expected, create a trimmed array */ if (idx < numNames) { jobjectArray trimmedArray = (*jenv)->NewObjectArray(jenv, idx, - objectClass, NULL); + objectArrayClass, NULL); if (trimmedArray != NULL && !(*jenv)->ExceptionCheck(jenv)) { for (i = 0; i < idx; i++) { jobject elem = (*jenv)->GetObjectArrayElement(jenv, From 7ed8a1a77f1039963de1792d2804eb11cbecb445 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:07:45 -0600 Subject: [PATCH 02/10] F-6549: free the DER buffer on the NewByteArray failure path in X509_REQ_get_der --- native/com_wolfssl_WolfSSLCertRequest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/native/com_wolfssl_WolfSSLCertRequest.c b/native/com_wolfssl_WolfSSLCertRequest.c index 9d87cd1..ab8db94 100644 --- a/native/com_wolfssl_WolfSSLCertRequest.c +++ b/native/com_wolfssl_WolfSSLCertRequest.c @@ -509,6 +509,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_WolfSSLCertRequest_X509_1REQ_1get_ if (derArr == NULL) { throwWolfSSLJNIException(jenv, "Failed to create byte array in native X509_REQ_get_der"); + XFREE(der, NULL, DYNAMIC_TYPE_OPENSSL); return NULL; } From a99a5fcb410143da5c6082f02841a93a7258226e Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:14:12 -0600 Subject: [PATCH 03/10] F-6733: size the internalSendCb grow buffer to include the existing offset --- src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java b/src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java index 514279e..01a6c9e 100644 --- a/src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java +++ b/src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java @@ -2672,14 +2672,14 @@ public class WolfSSLEngine extends SSLEngine { return 0; } - /* If we have more data than internal static buffer, - * grow buffer 2x (or up to sz needed) and copy data over */ + /* If we have more data than internal static buffer, grow buffer + * 2x (or up to offset + sz needed) and copy data over */ if ((this.internalIOSendBufSz - this.internalIOSendBufOffset) < sz) { - /* Allocate new buffer to hold data to be sent */ + int needed = this.internalIOSendBufOffset + sz; int newSz = this.internalIOSendBufSz * 2; - if (newSz < sz) { - newSz = sz; + if (newSz < needed) { + newSz = needed; } byte[] newBuf = new byte[newSz]; System.arraycopy(this.internalIOSendBuf, 0, From cdb0917f6cb69f12984ca313162de71501d6e746 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:18:03 -0600 Subject: [PATCH 04/10] F-6734: treat an unset jdk.tls.disabledAlgorithms as empty in sanitizeProtocols --- src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java b/src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java index e4b1bd8..2990f43 100644 --- a/src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java +++ b/src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java @@ -94,6 +94,10 @@ public class WolfSSLUtil { WolfSSLDebug.log(WolfSSLUtil.class, WolfSSLDebug.INFO, () -> "jdk.tls.disabledAlgorithms: " + tmpDisabledAlgos); + if (disabledAlgos == null) { + disabledAlgos = ""; + } + /* * WolfJSSE only supports DTLSv1.3, automatically add DTLSv1, * and DTLSv1.2 to disabled algorithms for now */ From e098668e38789de643fe3057388f490e8a4f402d Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:21:56 -0600 Subject: [PATCH 05/10] F-7010: base the cipher-suite separator on accumulator content, not loop index --- native/com_wolfssl_WolfSSL.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/native/com_wolfssl_WolfSSL.c b/native/com_wolfssl_WolfSSL.c index 70c6c22..c6da970 100644 --- a/native/com_wolfssl_WolfSSL.c +++ b/native/com_wolfssl_WolfSSL.c @@ -2644,15 +2644,17 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSL_getAvailableCipherSuitesIana ianaName = cipherName; #endif if (ianaName != NULL) { - /* colon separated list */ - if (i != 0 && (XSTRLEN(cipherList) + 1) < sizeof(cipherList)) { + /* colon separated list, only prepend separator once cipherList + * already holds a name */ + if (cipherList[0] != '\0' && + (XSTRLEN(cipherList) + 1) < sizeof(cipherList)) { XSTRNCAT(cipherList, ":", - sizeof(cipherList) - XSTRLEN(cipherList) - 1); + sizeof(cipherList) - XSTRLEN(cipherList) - 1); } if ((XSTRLEN(ianaName) + XSTRLEN(cipherList) + 1) < - sizeof(cipherList)) { + sizeof(cipherList)) { XSTRNCAT(cipherList, ianaName, - sizeof(cipherList) - XSTRLEN(cipherList) - 1); + sizeof(cipherList) - XSTRLEN(cipherList) - 1); } } } From cf37bf963c344a35fc1e47de3a418190cf41ec20 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:25:08 -0600 Subject: [PATCH 06/10] F-9115: gate SSLv3 in getProtocolsMask on the correctly spelled WOLFSSL_ALLOW_SSLV3 macro --- native/com_wolfssl_WolfSSL.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/native/com_wolfssl_WolfSSL.c b/native/com_wolfssl_WolfSSL.c index c6da970..db032f2 100644 --- a/native/com_wolfssl_WolfSSL.c +++ b/native/com_wolfssl_WolfSSL.c @@ -2916,7 +2916,7 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSL_getProtocolsMask } #endif /* WOLFSSL_ALLOW_TLSv10 */ #endif /* !NO_OLD_TLS */ -#ifdef WOLFSSL_ALLOW_SSLv3 +#ifdef WOLFSSL_ALLOW_SSLV3 if(!(mask & SSL_OP_NO_SSLv3)) { numProtocols += 1; } @@ -2979,7 +2979,7 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSL_getProtocolsMask #endif /* WOLFSSL_ALLOW_TLSv10 */ #endif /* !NO_OLD_TLS */ -#ifdef WOLFSSL_ALLOW_SSLv3 +#ifdef WOLFSSL_ALLOW_SSLV3 if(!(mask & SSL_OP_NO_SSLv3)) { (*jenv)->SetObjectArrayElement(jenv, ret, idx++, (*jenv)->NewStringUTF(jenv, "SSLv3")); From c6763af087145385262d413f8559ae595876c420 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:31:11 -0600 Subject: [PATCH 07/10] F-9116: apply the requested verify mode when the setVerify callback cannot be registered --- native/com_wolfssl_WolfSSLSession.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/native/com_wolfssl_WolfSSLSession.c b/native/com_wolfssl_WolfSSLSession.c index 8583318..1129ac7 100644 --- a/native/com_wolfssl_WolfSSLSession.c +++ b/native/com_wolfssl_WolfSSLSession.c @@ -4997,7 +4997,8 @@ JNIEXPORT void JNICALL Java_com_wolfssl_WolfSSLSession_setVerify *verifyCb = (*jenv)->NewGlobalRef(jenv, callbackIface); if (*verifyCb == NULL) { printf("error storing global callback interface\n"); - XFREE(verifyCb, NULL, DYNAMIC_TYPE_TMP_BUFFER); + XFREE(verifyCb, NULL, DYNAMIC_TYPE_TMP_BUFFER); + verifyCb = NULL; } else { /* Publish under g_verifyCbMutex so a concurrent callback @@ -5010,6 +5011,11 @@ JNIEXPORT void JNICALL Java_com_wolfssl_WolfSSLSession_setVerify wolfSSL_set_verify(ssl, mode, NativeSSLVerifyCallback); } } + + /* If callback could not be registered, still apply requested mode */ + if ((appData == NULL) || (verifyCb == NULL)) { + wolfSSL_set_verify(ssl, mode, NULL); + } } } From b5b8d7ee8ae75c85d01b00fb7898db56841dd54a Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:36:08 -0600 Subject: [PATCH 08/10] F-9117: guard against a NULL altname before NewStringUTF in getPeerX509AltName --- native/com_wolfssl_WolfSSLSession.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/native/com_wolfssl_WolfSSLSession.c b/native/com_wolfssl_WolfSSLSession.c index 1129ac7..cfb5f37 100644 --- a/native/com_wolfssl_WolfSSLSession.c +++ b/native/com_wolfssl_WolfSSLSession.c @@ -3569,6 +3569,9 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSLSession_getPeerX509AltName } altname = wolfSSL_X509_get_next_altname(x509); + if (altname == NULL) { + return NULL; + } retString = (*jenv)->NewStringUTF(jenv, altname); return retString; From 154b52bc78ebda98ea463e932959af1e3fdfa113 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 13 Aug 2026 16:39:21 -0600 Subject: [PATCH 09/10] F-9118: return an error from native read() on negative offset or length --- native/com_wolfssl_WolfSSLSession.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/native/com_wolfssl_WolfSSLSession.c b/native/com_wolfssl_WolfSSLSession.c index cfb5f37..1f7de56 100644 --- a/native/com_wolfssl_WolfSSLSession.c +++ b/native/com_wolfssl_WolfSSLSession.c @@ -1556,6 +1556,8 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_read__J_3BIII * 0 is used here to both commit and free */ (*jenv)->ReleaseByteArrayElements(jenv, raw, (jbyte*)data, 0); } + } else { + return BAD_FUNC_ARG; } return size; From 3a2c83763200b83d92eaab7c0c980abd0ba97461 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Fri, 14 Aug 2026 10:32:49 -0600 Subject: [PATCH 10/10] F-9119: validate min key size range before narrowing to word16/short --- native/com_wolfssl_WolfSSLContext.c | 24 ++++++++++++++++--- .../com/wolfssl/test/WolfSSLContextTest.java | 21 ++++++++++++++++ 2 files changed, 42 insertions(+), 3 deletions(-) diff --git a/native/com_wolfssl_WolfSSLContext.c b/native/com_wolfssl_WolfSSLContext.c index b992ad1..4797821 100644 --- a/native/com_wolfssl_WolfSSLContext.c +++ b/native/com_wolfssl_WolfSSLContext.c @@ -7088,11 +7088,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinDhKeySz WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr; (void)obj; - /* wolfSSL_CTX_SetMinDhKey_Sz() sanitizes ctx and keySzBits */ + /* wolfSSL_CTX_SetMinDhKey_Sz() sanitizes ctx */ if (jenv == NULL) { return (jint)BAD_FUNC_ARG; } + /* Validate range before narrowing to word16, otherwise out of range + * value can wrap to a smaller key size */ + if ((keySzBits < 0) || (keySzBits > (jint)WOLFSSL_MAX_16BIT)) { + return (jint)BAD_FUNC_ARG; + } + return (jint)wolfSSL_CTX_SetMinDhKey_Sz(ctx, (word16)keySzBits); #else (void)jenv; @@ -7110,11 +7116,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinRsaKeySz WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr; (void)obj; - /* wolfSSL_CTX_SetMinRsaKey_Sz() sanitizes ctx and keySzBits */ + /* wolfSSL_CTX_SetMinRsaKey_Sz() sanitizes ctx */ if (jenv == NULL) { return (jint)BAD_FUNC_ARG; } + /* Validate range before narrowing to short, otherwise out of range value + * can wrap to a smaller key size */ + if ((keySzBits < 0) || (keySzBits > INT16_MAX)) { + return (jint)BAD_FUNC_ARG; + } + return (jint)wolfSSL_CTX_SetMinRsaKey_Sz(ctx, (short)keySzBits); #else (void)jenv; @@ -7132,11 +7144,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinEccKeySz WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr; (void)obj; - /* wolfSSL_CTX_SetMinEccKey_Sz() sanitizes ctx and keySzBits */ + /* wolfSSL_CTX_SetMinEccKey_Sz() sanitizes ctx */ if (jenv == NULL) { return (jint)BAD_FUNC_ARG; } + /* Validate range before narrowing to short, otherwise out of range value + * can wrap to a smaller key size */ + if ((keySzBits < 0) || (keySzBits > INT16_MAX)) { + return (jint)BAD_FUNC_ARG; + } + return (jint)wolfSSL_CTX_SetMinEccKey_Sz(ctx, (short)keySzBits); #else (void)jenv; diff --git a/src/test/com/wolfssl/test/WolfSSLContextTest.java b/src/test/com/wolfssl/test/WolfSSLContextTest.java index 71e492b..534a4b2 100644 --- a/src/test/com/wolfssl/test/WolfSSLContextTest.java +++ b/src/test/com/wolfssl/test/WolfSSLContextTest.java @@ -762,6 +762,13 @@ public class WolfSSLContextTest { fail("setMinRSAKeySize should fail with negative key size"); } + /* value that wraps across the 16-bit boundary should fail, + * 66560 wraps to 1024. */ + ret = ctx.setMinRSAKeySize(66560); + if (ret != WolfSSL.BAD_FUNC_ARG) { + fail("setMinRSAKeySize should fail for out-of-range value"); + } + /* key length not % 8 should fail */ ret = ctx.setMinRSAKeySize(1023); if (ret != WolfSSL.BAD_FUNC_ARG) { @@ -814,6 +821,13 @@ public class WolfSSLContextTest { fail("setMinECCKeySize should fail with negative key size"); } + /* value that wraps across the 16-bit boundary should fail, + * 66048 narrows to 512. */ + ret = ctx.setMinECCKeySize(66048); + if (ret != WolfSSL.BAD_FUNC_ARG) { + fail("setMinECCKeySize should fail for out-of-range value"); + } + /* valid key length should succeed */ ret = ctx.setMinECCKeySize(128); if (ret != WolfSSL.SSL_SUCCESS) { @@ -868,6 +882,13 @@ public class WolfSSLContextTest { fail("setMinDHKeySize should fail with key size too large"); } + /* value that wraps across the 16-bit boundary should fail, + * 66560 narrows to 1024. */ + ret = ctx.setMinDHKeySize(66560); + if (ret != WolfSSL.BAD_FUNC_ARG) { + fail("setMinDHKeySize should fail for out-of-range value"); + } + /* key length not % 8 should fail */ ret = ctx.setMinDHKeySize(1023); if (ret != WolfSSL.BAD_FUNC_ARG) {