Correct partial-block guards in wc_AesCcmDecrypt

[embhorn]

Description

wc_AesCcmDecrypt() uses oSz as the working byte counter for its CTR-mode loop, keeping inSz pristine because the CBC-MAC phase further down needs the original message length to build B0. The two guards after that loop were never updated to match — they still test inSz, which is never decremented.

The hunk also removes the trailing counter-zeroing loop and AesEncrypt_preFetchOpt() call at the end of the partial-lock block. These are dead on every input size, not only block-aligned ones: the CBC-MAC phase immediately below overwrites A in full and rebuilds B[0] along with the same B[WC_AES_BLOCK_SIZE - 1 - i] bytes the loop had just zeroed.

There is no behavior change from either part of this hunk. Ciphertext, tag, and recovered plaintext are byte-identical to master across message sizes 0/1/15/16/17/31/32/33/47/48/49/63/64/65/81/128. The only functional effect is fewer AES block operations — two fewer for block-aligned input, one fewer otherwise.

Fixes zd22271

Testing

New aesccm_128_aligned_test() in wolfcrypt/test/test.c, called from aesccm_128_test(). The existing AES-CCM vectors are 23 and 73 bytes, both with a partial trailing block, so no test exercised block-aligned CCM at all.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11040

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Fixes AES-CCM decryption’s post-CTR-loop “partial block remaining” guards to use the correct remaining-byte counter (oSz) and adds new test vectors to cover block-aligned message lengths that were previously untested.

Changes:

• Update wc_AesCcmDecrypt() to guard partial-block handling using oSz (bytes remaining after CTR loop) rather than inSz.
• Add aesccm_128_aligned_test() with 1-block and 4-block aligned vectors (plus corrupted-tag negative case) and wire it into aesccm_128_test().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
wolfcrypt/src/aes.c	Corrects post-CTR-loop conditional checks to use the remaining-bytes counter for partial-block handling.
wolfcrypt/test/test.c	Adds aligned-length AES-CCM test vectors and integrates them into the existing AES-CCM 128-bit test flow.

Suppressed comments (1)

wolfcrypt/test/test.c:1

• The comment says “one block”, but t1 is an 8-byte tag (not an AES block). Suggest updating the comment to reflect the configured tag length (e.g., “tag - authentication - 8 bytes”) for clarity and to avoid confusion when reading these vectors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-dtls13

• FLASH: .text -64 B (-0.0%, 181,476 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text -64 B (-0.0%, 213,844 B / 262,144 B, total: 82% used)

linuxkm-pie

• Data: __patchable_function_entries +8 B (+0.0%, 26,360 B)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 49,120 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753