From e6dd0cb4e008048e4c095585427c3f82e12b74f7 Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Tue, 18 Aug 2026 16:02:07 -0600
Subject: [PATCH] F-4620: return an error when GetStringUTFChars yields NULL in
 file and hint setters

---
 native/com_wolfssl_WolfSSLContext.c | 36 ++++++++++++++++++++++++-----
 native/com_wolfssl_WolfSSLSession.c | 21 +++++++++++++++++
 2 files changed, 51 insertions(+), 6 deletions(-)

diff --git a/native/com_wolfssl_WolfSSLContext.c b/native/com_wolfssl_WolfSSLContext.c
index d0c0898..3688048 100644
--- a/native/com_wolfssl_WolfSSLContext.c
+++ b/native/com_wolfssl_WolfSSLContext.c
@@ -439,12 +439,14 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setTmpDHFile
             return (jint)SSL_FAILURE;
         }
         (*jenv)->ThrowNew(jenv, excClass,
-                "Input WolfSSLContext object was null in "
-                "setTmpDHFile");
+            "Input WolfSSLContext object was null in setTmpDHFile");
         return (jint)SSL_FAILURE;
     }
 
     fname = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (fname == NULL) {
+        return (jint)SSL_FAILURE;
+    }
 
     ret = wolfSSL_CTX_SetTmpDH_file(ctx, fname, format);
 
@@ -482,13 +484,15 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_useCertificateFile
             (*jenv)->ExceptionClear(jenv);
         }
         /* throw NullPointerException */
-        (*jenv)->ThrowNew(jenv, excClass,
-                "Input certificate file is NULL");
+        (*jenv)->ThrowNew(jenv, excClass, "Input certificate file is NULL");
 
         return (jint)SSL_FAILURE;
     }
 
     certFile = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (certFile == NULL) {
+        return (jint)SSL_FAILURE;
+    }
 
     ret = (jint) wolfSSL_CTX_use_certificate_file(ctx, certFile, (int)format);
 
@@ -526,13 +530,15 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_usePrivateKeyFile
             (*jenv)->ExceptionClear(jenv);
         }
         /* throw NullPointerException */
-        (*jenv)->ThrowNew(jenv, excClass,
-                "Input private key file is NULL");
+        (*jenv)->ThrowNew(jenv, excClass, "Input private key file is NULL");
 
         return (jint)SSL_FAILURE;
     }
 
     keyFile = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (keyFile == NULL) {
+        return (jint)SSL_FAILURE;
+    }
 
     ret = (jint) wolfSSL_CTX_use_PrivateKey_file(ctx, keyFile, (int)format);
 
@@ -579,12 +585,21 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_loadVerifyLocations
 
     if (file) {
         caFile = (*jenv)->GetStringUTFChars(jenv, file, 0);
+        if (caFile == NULL) {
+            return (jint)SSL_FAILURE;
+        }
     } else {
         caFile = NULL;
     }
 
     if (path) {
         caPath = (*jenv)->GetStringUTFChars(jenv, path, 0);
+        if (caPath == NULL) {
+            if (caFile) {
+                (*jenv)->ReleaseStringUTFChars(jenv, file, caFile);
+            }
+            return (jint)SSL_FAILURE;
+        }
     } else {
         caPath = NULL;
     }
@@ -636,6 +651,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_useCertificateChainFile
     }
 
     chainFile = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (chainFile == NULL) {
+        return (jint)SSL_FAILURE;
+    }
 
     ret = (jint) wolfSSL_CTX_use_certificate_chain_file(ctx, chainFile);
 
@@ -2098,6 +2116,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_loadCRL
     }
 
     crlPath = (*jenv)->GetStringUTFChars(jenv, path, 0);
+    if (crlPath == NULL) {
+        return (jint)SSL_FAILURE;
+    }
 
     ret = wolfSSL_CTX_LoadCRL(ctx, crlPath, type, monitor);
 
@@ -7093,6 +7114,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_usePskIdentityHint
     }
 
     nativeHint = (*jenv)->GetStringUTFChars(jenv, hint, 0);
+    if (nativeHint == NULL) {
+        return (jint)SSL_FAILURE;
+    }
 
     ret = (jint)wolfSSL_CTX_use_psk_identity_hint(ctx, nativeHint);
 
diff --git a/native/com_wolfssl_WolfSSLSession.c b/native/com_wolfssl_WolfSSLSession.c
index 901f433..e8d2a03 100644
--- a/native/com_wolfssl_WolfSSLSession.c
+++ b/native/com_wolfssl_WolfSSLSession.c
@@ -639,6 +639,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_useCertificateFile
     }
 
     certFile = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (certFile == NULL) {
+        return SSL_FAILURE;
+    }
 
     ret = (jint) wolfSSL_use_certificate_file(ssl, certFile, (int)format);
 
@@ -673,6 +676,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_usePrivateKeyFile
     }
 
     keyFile = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (keyFile == NULL) {
+        return SSL_FAILURE;
+    }
 
     ret = (jint) wolfSSL_use_PrivateKey_file(ssl, keyFile, (int)format);
 
@@ -707,6 +713,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_useCertificateChainFile
     }
 
     chainFile = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (chainFile == NULL) {
+        return SSL_FAILURE;
+    }
 
     ret = (jint) wolfSSL_use_certificate_chain_file(ssl, chainFile);
 
@@ -3647,6 +3656,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_checkDomainName
     }
 
     dname = (*jenv)->GetStringUTFChars(jenv, dn, 0);
+    if (dname == NULL) {
+        return SSL_FAILURE;
+    }
 
     ret = wolfSSL_check_domain_name(ssl, dname);
 
@@ -3745,6 +3757,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_setTmpDHFile
     }
 
     fname = (*jenv)->GetStringUTFChars(jenv, file, 0);
+    if (fname == NULL) {
+        return SSL_FAILURE;
+    }
 
     ret = wolfSSL_SetTmpDH_file(ssl, fname, format);
 
@@ -4016,6 +4031,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_loadCRL
     }
 
     crlPath = (*jenv)->GetStringUTFChars(jenv, path, 0);
+    if (crlPath == NULL) {
+        return SSL_FAILURE;
+    }
 
     ret = wolfSSL_LoadCRL(ssl, crlPath, type, monitor);
 
@@ -4926,6 +4944,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_usePskIdentityHint
     }
 
     nativeHint = (*jenv)->GetStringUTFChars(jenv, hint, 0);
+    if (nativeHint == NULL) {
+        return SSL_FAILURE;
+    }
 
     ret = (jint)wolfSSL_use_psk_identity_hint(ssl, nativeHint);