Skip to content

Fix: Test memory leak and Failing test when md5 and sha are enabled #11025

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidankeefe2022 wants to merge 2 commits into
base: master
Choose a base branch
from
+35 −18
Open

Fix: Test memory leak and Failing test when md5 and sha are enabled #11025

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3fdff2d
tests: guard weak-hash checks on WC_SIG_MIN_HASH_TYPE, fix RNG cleanup
aidankeefe2022 Jul 31, 2026
7481acb
review fix
aidankeefe2022 Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 35 additions & 18 deletions tests/api/test_signature.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,13 @@
#include <tests/api/api.h>
#include <tests/api/test_signature.h>

/* Must be kept in sync with wolfcrypt/src/signature.c */
#ifndef WC_SIG_MIN_HASH_TYPE
#define TEST_SIG_MIN_HASH_TYPE WC_HASH_TYPE_SHA256
#else
#define TEST_SIG_MIN_HASH_TYPE WC_SIG_MIN_HASH_TYPE
#endif

/* Testing wc_SignatureGetSize() for signature type ECC */
int test_wc_SignatureGetSize_ecc(void)
{
Expand Down Expand Up @@ -182,7 +189,7 @@ int test_wc_falcon_sign_verify(void)
XMEMSET(&key, 0, sizeof(key));
ExpectIntEQ(wc_falcon_init(&key), 0);
ExpectIntEQ(wc_falcon_set_level(&key, 1), 0);
ExpectIntEQ(wc_InitRng(&rng), 0);
DoExpectIntEQ(wc_InitRng(&rng), 0);

/* Use the embedded benchmark key rather than generating one: this is a
* wrapper-level smoke test (the native suite lives in test_falcon.c), so
Expand Down Expand Up @@ -304,7 +311,7 @@ int test_wc_SignatureDecisionCoverage(void)
WC_RNG rng;

XMEMSET(data, 0x5A, sizeof(data));
ExpectIntEQ(wc_InitRng(&rng), 0);
DoExpectIntEQ(wc_InitRng(&rng), 0);

ExpectIntEQ(wc_SignatureVerify(WC_HASH_TYPE_SHA256, sig_type,
NULL, data_len, sig, sig_len, &ecc, key_len),
Expand Down Expand Up @@ -334,13 +341,18 @@ int test_wc_SignatureDecisionCoverage(void)
ExpectIntEQ(wc_SignatureVerify((enum wc_HashType)999, sig_type,
data, data_len, sig, sig_len, &ecc, key_len),
WC_NO_ERR_TRACE(BAD_FUNC_ARG));

#ifndef NO_SHA
/* Hash weaker than WC_SIG_MIN_HASH_TYPE (default SHA-256)
* rejected by wc_SignatureCheckHashStrength() */
ExpectIntEQ(wc_SignatureVerify(WC_HASH_TYPE_SHA, sig_type,
data, data_len, sig, sig_len, &ecc, key_len),
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
#if !defined(NO_SHA)
if (TEST_SIG_MIN_HASH_TYPE > WC_HASH_TYPE_SHA) {
ExpectIntEQ(wc_SignatureVerify(WC_HASH_TYPE_SHA, sig_type,
data, data_len, sig, sig_len, &ecc, key_len),
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
}
else {
/* If SHA is allowed error should come from the sig */
ExpectIntEQ(wc_SignatureVerify(WC_HASH_TYPE_SHA, sig_type,
data, data_len, sig, sig_len, &ecc, key_len),
WC_NO_ERR_TRACE(SIG_VERIFY_E));
}
#endif

/* Real signature that fails verification: SIG_VERIFY_E.
Expand Down Expand Up @@ -397,7 +409,7 @@ int test_wc_SignatureDecisionCoverage(void)
word32 genSigLen = (word32)eccSigMax;
WC_RNG rng;

ExpectIntEQ(wc_InitRng(&rng), 0);
DoExpectIntEQ(wc_InitRng(&rng), 0);

ExpectIntEQ(wc_SignatureGenerateHash_ex(WC_HASH_TYPE_SHA256,
sig_type, NULL, hash_len, genSig, &genSigLen, &ecc, key_len,
Expand Down Expand Up @@ -474,7 +486,7 @@ int test_wc_SignatureDecisionCoverage(void)
WC_RNG rng;

XMEMSET(data, 0xA5, sizeof(data));
ExpectIntEQ(wc_InitRng(&rng), 0);
DoExpectIntEQ(wc_InitRng(&rng), 0);

ExpectIntEQ(wc_SignatureGenerate(WC_HASH_TYPE_SHA256, sig_type,
NULL, data_len, genSig, &genSigLen, &ecc, key_len, &rng),
Expand Down Expand Up @@ -516,15 +528,20 @@ int test_wc_SignatureDecisionCoverage(void)
sig_type, data, data_len, genSig, &lenCopy, &ecc,
key_len, &rng), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
}

#ifndef NO_SHA
/* Weak hash rejected before any hashing/signing occurs */
{
#if !defined(NO_SHA)
if (TEST_SIG_MIN_HASH_TYPE > WC_HASH_TYPE_SHA) {
word32 lenCopy = (word32)eccSigMax;
ExpectIntEQ(wc_SignatureGenerate(WC_HASH_TYPE_SHA, sig_type,
data, data_len, genSig, &lenCopy, &ecc, key_len, &rng),
WC_NO_ERR_TRACE(BAD_FUNC_ARG));
}
else {
/* Floor lowered : SHA-1 must get past the
* strength check and fail on the signature itself instead. */
ExpectIntEQ(wc_SignatureVerify(WC_HASH_TYPE_SHA, sig_type,
data, data_len, sig, sig_len, &ecc, key_len),
WC_NO_ERR_TRACE(SIG_VERIFY_E));
}
#endif

DoExpectIntEQ(wc_FreeRng(&rng), 0);
Expand Down Expand Up @@ -632,7 +649,7 @@ int test_wc_SignatureDecisionCoverage(void)

XMEMSET(data, 0x24, sizeof(data));
XMEMSET(otherData, 0x99, sizeof(otherData));
ExpectIntEQ(wc_InitRng(&rng), 0);
DoExpectIntEQ(wc_InitRng(&rng), 0);
ExpectIntEQ(wc_SignatureGenerate(WC_HASH_TYPE_SHA256,
WC_SIGNATURE_TYPE_RSA, data, data_len, realSig, &realSigLen,
&rsa_key, key_len, &rng), 0);
Expand Down Expand Up @@ -681,7 +698,7 @@ int test_wc_SignatureFeatureCoverage(void)

ExpectIntEQ(wc_ecc_init(&ecc), 0);
ExpectIntEQ(wc_ecc_import_raw(&ecc, qx, qy, d, "SECP256R1"), 0);
ExpectIntEQ(wc_InitRng(&rng), 0);
DoExpectIntEQ(wc_InitRng(&rng), 0);

/* wc_SignatureGetSize(): positive path for ECC */
ExpectIntGT(wc_SignatureGetSize(sig_type, &ecc, key_len), 0);
Expand Down Expand Up @@ -767,7 +784,7 @@ int test_wc_SignatureFeatureCoverage(void)
ExpectIntEQ(wc_InitRsaKey_ex(&rsa_key, HEAP_HINT, testDevId), 0);
ExpectIntEQ(wc_RsaPrivateKeyDecode(tmp, &idx, &rsa_key,
(word32)bytes), 0);
ExpectIntEQ(wc_InitRng(&rng), 0);
DoExpectIntEQ(wc_InitRng(&rng), 0);

/* wc_SignatureGetSize(): positive path for RSA */
ExpectIntGT(wc_SignatureGetSize(WC_SIGNATURE_TYPE_RSA, &rsa_key,
Expand Down
Loading