luna - wolfssl/tests/api/test

   1/* test_asn.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#include <tests/api/api.h>
  25#include <tests/api/test_asn.h>
  26
  27#include <wolfssl/wolfcrypt/asn.h>
  28#include <wolfssl/wolfcrypt/asn_public.h>
  29#include <wolfssl/wolfcrypt/random.h>
  30#include <wolfssl/wolfcrypt/rsa.h>
  31#ifdef HAVE_ED25519
  32    #include <wolfssl/wolfcrypt/ed25519.h>
  33#endif
  34
  35#if defined(WC_ENABLE_ASYM_KEY_EXPORT) && defined(HAVE_ED25519)
  36static int test_SetAsymKeyDer_once(byte* privKey, word32 privKeySz, byte* pubKey,
  37    word32 pubKeySz, byte* trueDer, word32 trueDerSz)
  38{
  39    EXPECT_DECLS;
  40
  41    byte* calcDer = NULL;
  42    word32 calcDerSz = 0;
  43
  44    ExpectIntEQ(calcDerSz = SetAsymKeyDer(privKey, privKeySz, pubKey, pubKeySz,
  45        NULL, 0, ED25519k), trueDerSz);
  46    ExpectNotNull(calcDer = (byte*)XMALLOC(calcDerSz, NULL,
  47        DYNAMIC_TYPE_TMP_BUFFER));
  48    ExpectIntEQ(calcDerSz = SetAsymKeyDer(privKey, privKeySz, pubKey, pubKeySz,
  49        calcDer, calcDerSz, ED25519k), trueDerSz);
  50    ExpectIntEQ(XMEMCMP(calcDer, trueDer, trueDerSz), 0);
  51    XFREE(calcDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  52
  53    return EXPECT_RESULT();
  54}
  55#endif /* WC_ENABLE_ASYM_KEY_EXPORT && HAVE_ED25519 */
  56
  57int test_SetAsymKeyDer(void)
  58{
  59    EXPECT_DECLS;
  60
  61#if defined(WC_ENABLE_ASYM_KEY_EXPORT) && defined(HAVE_ED25519)
  62    /* We can't access the keyEd25519Oid variable, so declare it instead */
  63    byte algId[] = {43, 101, 112};
  64    /* RFC 5958: version is v1 (0) for private only, v2 (1) when public key
  65     * bundled. Conditions 1-5 are private only, 6-8 include pub key and
  66     * mutate version[0] = 0x1 before building trueDer. */
  67    byte version[] = {0x0};
  68    byte keyPat = 0xcc;
  69
  70    byte* privKey = NULL;
  71    word32 privKeySz = 0;
  72    byte* pubKey = NULL;
  73    word32 pubKeySz = 0;
  74    byte trueDer[310]; /* The largest size is 310 bytes on Condition 8 */
  75    word32 trueDerSz = 0;
  76
  77    /*
  78     * Condition 1:
  79     *     PKEY data = 34            (1 to 127)
  80     *     PKEY_CURVEPKEY data = 32  (1 to 127)
  81     *     PUBKEY data = 0           (Empty)
  82     *     SEQ data = 46             (1 to 127)
  83     */
  84    privKeySz = 32;
  85    pubKeySz = 0;
  86    trueDerSz = 48;
  87
  88    /* SEQ */
  89    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
  90    trueDer[1]  = trueDerSz - 2;
  91    /* VER */
  92    trueDer[2]  = ASN_INTEGER;
  93    trueDer[3]  = sizeof(version);
  94    trueDer[4]  = version[0];
  95    /* PKEYALGO_SEQ */
  96    trueDer[5]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
  97    trueDer[6]  = sizeof(algId) + 2;
  98    trueDer[7]  = ASN_OBJECT_ID;
  99    trueDer[8]  = sizeof(algId);
 100    trueDer[9]  = algId[0];
 101    trueDer[10] = algId[1];
 102    trueDer[11] = algId[2];
 103    /* PKEY */
 104    trueDer[12] = ASN_OCTET_STRING;
 105    trueDer[13] = privKeySz + 2;
 106    trueDer[14] = ASN_OCTET_STRING;
 107    trueDer[15] = privKeySz;
 108    privKey     = &trueDer[16];
 109    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[16] to trueDer[47] */
 110    /* PUBKEY */
 111    pubKey = NULL; /* Empty */
 112
 113    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 114        trueDer, trueDerSz));
 115
 116    /*
 117     * Condition 2:
 118     *     PKEY data = 129          (128 to 255)
 119     *     PKEY_CURVEKEY data = 127 (0 to 127)
 120     *     PUBKEY data = 0          (Empty)
 121     *     SEQ data = 142           (128 to 255)
 122     */
 123    privKeySz = 127;
 124    pubKeySz = 0;
 125    trueDerSz = 145;
 126
 127    /* SEQ */
 128    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 129    trueDer[1]  = 0x81;
 130    trueDer[2]  = trueDerSz - 3;
 131    /* VER */
 132    trueDer[3]  = ASN_INTEGER;
 133    trueDer[4]  = sizeof(version);
 134    trueDer[5]  = version[0];
 135    /* PKEYALGO_SEQ */
 136    trueDer[6]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 137    trueDer[7]  = sizeof(algId) + 2;
 138    trueDer[8]  = ASN_OBJECT_ID;
 139    trueDer[9]  = sizeof(algId);
 140    trueDer[10] = algId[0];
 141    trueDer[11] = algId[1];
 142    trueDer[12] = algId[2];
 143    /* PKEY */
 144    trueDer[13] = ASN_OCTET_STRING;
 145    trueDer[14] = 0x81;
 146    trueDer[15] = privKeySz + 2;
 147    trueDer[16] = ASN_OCTET_STRING;
 148    trueDer[17] = privKeySz;
 149    privKey     = &trueDer[18];
 150    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[18] to trueDer[144] */
 151    /* PUBKEY */
 152    pubKey = NULL; /* Empty */
 153
 154    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 155        trueDer, trueDerSz));
 156
 157    /*
 158     * Condition 3:
 159     *     PKEY data = 131     (128 to 255)
 160     *     PKEY_CURVEKEY = 128 (128 to 255)
 161     *     PUBKEY data = 0     (Empty)
 162     *     SEQ data =144       (128 to 255)
 163     */
 164    privKeySz = 128;
 165    pubKeySz = 0;
 166    trueDerSz = 147;
 167
 168    /* SEQ */
 169    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 170    trueDer[1]  = 0x81;
 171    trueDer[2]  = trueDerSz - 3;
 172    /* VER */
 173    trueDer[3]  = ASN_INTEGER;
 174    trueDer[4]  = sizeof(version);
 175    trueDer[5]  = version[0];
 176    /* PKEYALGO_SEQ */
 177    trueDer[6]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 178    trueDer[7]  = sizeof(algId) + 2;
 179    trueDer[8]  = ASN_OBJECT_ID;
 180    trueDer[9]  = sizeof(algId);
 181    trueDer[10] = algId[0];
 182    trueDer[11] = algId[1];
 183    trueDer[12] = algId[2];
 184    /* PKEY */
 185    trueDer[13] = ASN_OCTET_STRING;
 186    trueDer[14] = 0x81;
 187    trueDer[15] = privKeySz + 3;
 188    trueDer[16] = ASN_OCTET_STRING;
 189    trueDer[17] = 0x81;
 190    trueDer[18] = privKeySz;
 191    privKey     = &trueDer[19];
 192    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[19] to trueDer[146] */
 193    /* PUBKEY */
 194    pubKey = NULL; /* Empty */
 195
 196    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 197        trueDer, trueDerSz));
 198
 199    /*
 200     * Condition 4:
 201     *     PKEY data = 258           (256 to 65535)
 202     *     PKEY_CURVEPKEY data = 255 (128 to 255)
 203     *     PUBKEY data = 0           (Empty)
 204     *     SEQ data = 272            (256 to 65536)
 205     */
 206    privKeySz = 255;
 207    pubKeySz = 0;
 208    trueDerSz = 276;
 209
 210    /* SEQ */
 211    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 212    trueDer[1]  = 0x82;
 213    trueDer[2]  = ((trueDerSz - 4) >> 8) & 0xff;
 214    trueDer[3]  = (trueDerSz - 4) & 0xff;
 215    /* VER */
 216    trueDer[4]  = ASN_INTEGER;
 217    trueDer[5]  = sizeof(version);
 218    trueDer[6]  = version[0];
 219    /* PKEYALGO_SEQ */
 220    trueDer[7]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 221    trueDer[8]  = sizeof(algId) + 2;
 222    trueDer[9]  = ASN_OBJECT_ID;
 223    trueDer[10] = sizeof(algId);
 224    trueDer[11] = algId[0];
 225    trueDer[12] = algId[1];
 226    trueDer[13] = algId[2];
 227    /* PKEY */
 228    trueDer[14] = ASN_OCTET_STRING;
 229    trueDer[15] = 0x82;
 230    trueDer[16] = ((privKeySz + 3) >> 8) & 0xff;
 231    trueDer[17] = (privKeySz + 3) & 0xff;
 232    trueDer[18] = ASN_OCTET_STRING;
 233    trueDer[19] = 0x81;
 234    trueDer[20] = privKeySz;
 235    privKey     = &trueDer[21];
 236    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[21] to trueDer[275] */
 237    /* PUBKEY */
 238    pubKey = NULL; /* Empty */
 239
 240    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 241        trueDer, trueDerSz));
 242
 243    /*
 244     * Condition 5:
 245     *     PKEY data = 260           (256 to 65535)
 246     *     PKEY_CURVEPKEY data = 256 (256 to 65535)
 247     *     PUBKEY data = 0           (Empty)
 248     *     SEQ data = 274            (256 to 65535)
 249     */
 250    privKeySz = 256;
 251    pubKeySz = 0;
 252    trueDerSz = 278;
 253
 254    /* SEQ */
 255    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 256    trueDer[1]  = 0x82;
 257    trueDer[2]  = ((trueDerSz - 4) >> 8) & 0xff;
 258    trueDer[3]  = (trueDerSz - 4) & 0xff;
 259    /* VER */
 260    trueDer[4]  = ASN_INTEGER;
 261    trueDer[5]  = sizeof(version);
 262    trueDer[6]  = version[0];
 263    /* PKEYALGO_SEQ */
 264    trueDer[7]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 265    trueDer[8]  = sizeof(algId) + 2;
 266    trueDer[9]  = ASN_OBJECT_ID;
 267    trueDer[10] = sizeof(algId);
 268    trueDer[11] = algId[0];
 269    trueDer[12] = algId[1];
 270    trueDer[13] = algId[2];
 271    /* PKEY */
 272    trueDer[14] = ASN_OCTET_STRING;
 273    trueDer[15] = 0x82;
 274    trueDer[16] = ((privKeySz + 4) >> 8) & 0xff;
 275    trueDer[17] = (privKeySz + 4) & 0xff;
 276    trueDer[18] = ASN_OCTET_STRING;
 277    trueDer[19] = 0x82;
 278    trueDer[20] = (privKeySz >> 8) & 0xff;
 279    trueDer[21] = privKeySz & 0xff;
 280    privKey     = &trueDer[22];
 281    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[22] to trueDer[277] */
 282    /* PUBKEY */
 283    pubKey = NULL; /* Empty */
 284
 285    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 286        trueDer, trueDerSz));
 287
 288    /*
 289     * Condition 6:
 290     *     PKEY data = 34            (1 to 127)
 291     *     PKEY_CURVEPKEY data = 32  (1 to 127)
 292     *     PUBKEY data = 32          (1 to 127)
 293     *     SEQ data = 80             (1 to 127)
 294     */
 295    privKeySz = 32;
 296    pubKeySz = 32;
 297    trueDerSz = 82;
 298    version[0] = 0x1; /* publicKey present (v2) */
 299
 300    /* SEQ */
 301    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 302    trueDer[1]  = trueDerSz - 2;
 303    /* VER */
 304    trueDer[2]  = ASN_INTEGER;
 305    trueDer[3]  = sizeof(version);
 306    trueDer[4]  = version[0];
 307    /* PKEYALGO_SEQ */
 308    trueDer[5]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 309    trueDer[6]  = sizeof(algId) + 2;
 310    trueDer[7]  = ASN_OBJECT_ID;
 311    trueDer[8]  = sizeof(algId);
 312    trueDer[9]  = algId[0];
 313    trueDer[10] = algId[1];
 314    trueDer[11] = algId[2];
 315    /* PKEY */
 316    trueDer[12] = ASN_OCTET_STRING;
 317    trueDer[13] = privKeySz + 2;
 318    trueDer[14] = ASN_OCTET_STRING;
 319    trueDer[15] = privKeySz;
 320    privKey     = &trueDer[16];
 321    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[16] to trueDer[47] */
 322    /* PUBKEY */
 323    trueDer[48] = ASN_CONTEXT_SPECIFIC | ASN_ASYMKEY_PUBKEY;
 324    trueDer[49] = pubKeySz;
 325    pubKey      = &trueDer[50];
 326    XMEMSET(pubKey, keyPat, pubKeySz); /* trueDer[50] to trueDer[81] */
 327
 328    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 329        trueDer, trueDerSz));
 330
 331    /*
 332     * Condition 7:
 333     *     PKEY data = 34            (1 to 127)
 334     *     PKEY_CURVEPKEY data = 32  (1 to 127)
 335     *     PUBKEY data = 128         (128 to 255)
 336     *     SEQ data = 180            (128 to 255)
 337     */
 338    privKeySz = 32;
 339    pubKeySz = 128;
 340    trueDerSz = 180;
 341    version[0] = 0x1; /* publicKey present (v2) */
 342
 343    /* SEQ */
 344    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 345    trueDer[1]  = 0x81;
 346    trueDer[2]  = trueDerSz - 3;
 347    /* VER */
 348    trueDer[3]  = ASN_INTEGER;
 349    trueDer[4]  = sizeof(version);
 350    trueDer[5]  = version[0];
 351    /* PKEYALGO_SEQ */
 352    trueDer[6]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 353    trueDer[7]  = sizeof(algId) + 2;
 354    trueDer[8]  = ASN_OBJECT_ID;
 355    trueDer[9]  = sizeof(algId);
 356    trueDer[10] = algId[0];
 357    trueDer[11] = algId[1];
 358    trueDer[12] = algId[2];
 359    /* PKEY */
 360    trueDer[13] = ASN_OCTET_STRING;
 361    trueDer[14] = privKeySz + 2;
 362    trueDer[15] = ASN_OCTET_STRING;
 363    trueDer[16] = privKeySz;
 364    privKey     = &trueDer[17];
 365    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[17] to trueDer[48] */
 366    /* PUBKEY */
 367    trueDer[49] = ASN_CONTEXT_SPECIFIC | ASN_ASYMKEY_PUBKEY;
 368    trueDer[50] = 0x81;
 369    trueDer[51] = pubKeySz;
 370    pubKey      = &trueDer[52];
 371    XMEMSET(pubKey, keyPat, pubKeySz); /* trueDer[52] to trueDer[179] */
 372
 373    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 374        trueDer, trueDerSz));
 375
 376    /*
 377     * Condition 8:
 378     *     PKEY data = 34            (1 to 127)
 379     *     PKEY_CURVEPKEY data = 32  (1 to 127)
 380     *     PUBKEY data = 256         (256 to 65535)
 381     *     SEQ data = 306            (256 to 65535)
 382     */
 383    privKeySz = 32;
 384    pubKeySz = 256;
 385    trueDerSz = 310;
 386    version[0] = 0x1; /* publicKey present (v2) */
 387
 388    /* SEQ */
 389    trueDer[0]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 390    trueDer[1]  = 0x82;
 391    trueDer[2]  = ((trueDerSz - 4) >> 8) & 0xff;
 392    trueDer[3]  = (trueDerSz - 4) & 0xff;
 393    /* VER */
 394    trueDer[4]  = ASN_INTEGER;
 395    trueDer[5]  = sizeof(version);
 396    trueDer[6]  = version[0];
 397    /* PKEYALGO_SEQ */
 398    trueDer[7]  = ASN_SEQUENCE | ASN_CONSTRUCTED;
 399    trueDer[8]  = sizeof(algId) + 2;
 400    trueDer[9]  = ASN_OBJECT_ID;
 401    trueDer[10] = sizeof(algId);
 402    trueDer[11] = algId[0];
 403    trueDer[12] = algId[1];
 404    trueDer[13] = algId[2];
 405    /* PKEY */
 406    trueDer[14] = ASN_OCTET_STRING;
 407    trueDer[15] = privKeySz + 2;
 408    trueDer[16] = ASN_OCTET_STRING;
 409    trueDer[17] = privKeySz;
 410    privKey     = &trueDer[18];
 411    XMEMSET(privKey, keyPat, privKeySz); /* trueDer[18] to trueDer[49] */
 412    /* PUBKEY */
 413    trueDer[50] = ASN_CONTEXT_SPECIFIC | ASN_ASYMKEY_PUBKEY;
 414    trueDer[51] = 0x82;
 415    trueDer[52] = (pubKeySz >> 8) & 0xff;
 416    trueDer[53] = pubKeySz & 0xff;
 417    pubKey      = &trueDer[54];
 418    XMEMSET(pubKey, keyPat, pubKeySz); /* trueDer[54] to trueDer[309] */
 419
 420    EXPECT_TEST(test_SetAsymKeyDer_once(privKey, privKeySz, pubKey, pubKeySz,
 421        trueDer, trueDerSz));
 422#endif /* WC_ENABLE_ASYM_KEY_EXPORT && HAVE_ED25519 */
 423
 424    return EXPECT_RESULT();
 425
 426}
 427
 428/* RFC 5958 leniency: parser must accept all four variants:
 429 *   {v=0,v=1} x {publicKey absent, present}. */
 430int test_DecodeAsymKey_lenient_versions(void)
 431{
 432    EXPECT_DECLS;
 433#if defined(HAVE_ED25519) && defined(HAVE_ED25519_KEY_EXPORT) && \
 434    defined(HAVE_ED25519_KEY_IMPORT) && defined(WOLFSSL_KEY_GEN)
 435    ed25519_key key;
 436    ed25519_key parsed;
 437    WC_RNG rng;
 438    byte bundled[256];   /* v=1 + publicKey */
 439    byte privOnly[256];  /* v=0, no publicKey */
 440    byte tmp[256];
 441    int  bundledSz = 0;
 442    int  privOnlySz = 0;
 443    word32 idx;
 444
 445    XMEMSET(&key,    0, sizeof(key));
 446    XMEMSET(&parsed, 0, sizeof(parsed));
 447    XMEMSET(&rng,    0, sizeof(rng));
 448
 449    ExpectIntEQ(wc_InitRng(&rng), 0);
 450    ExpectIntEQ(wc_ed25519_init(&key), 0);
 451    ExpectIntEQ(wc_ed25519_make_key(&rng, ED25519_KEY_SIZE, &key), 0);
 452
 453    ExpectIntGT(bundledSz = wc_Ed25519KeyToDer(&key, bundled,
 454        (word32)sizeof(bundled)), 0);
 455    ExpectIntGT(privOnlySz = wc_Ed25519PrivateKeyToDer(&key, privOnly,
 456        (word32)sizeof(privOnly)), 0);
 457
 458    if (EXPECT_SUCCESS() &&
 459        ((bundledSz  > 0) && ((size_t)bundledSz  <= sizeof(bundled)) &&
 460         (privOnlySz > 0) && ((size_t)privOnlySz <= sizeof(privOnly)))) {
 461
 462        /* v=1 + publicKey */
 463        XMEMCPY(tmp, bundled, (size_t)bundledSz);
 464        XMEMSET(&parsed, 0, sizeof(parsed));
 465        ExpectIntEQ(wc_ed25519_init(&parsed), 0);
 466        idx = 0;
 467        ExpectIntEQ(wc_Ed25519PrivateKeyDecode(tmp, &idx, &parsed,
 468            (word32)bundledSz), 0);
 469        wc_ed25519_free(&parsed);
 470
 471        /* v=0 + publicKey: patch version byte, [1] publicKey field present. */
 472        XMEMCPY(tmp, bundled, (size_t)bundledSz);
 473        ExpectIntGT(test_pkcs8_patch_version_byte(tmp, (word32)bundledSz, 0),
 474            0);
 475        XMEMSET(&parsed, 0, sizeof(parsed));
 476        ExpectIntEQ(wc_ed25519_init(&parsed), 0);
 477        idx = 0;
 478        ExpectIntEQ(wc_Ed25519PrivateKeyDecode(tmp, &idx, &parsed,
 479            (word32)bundledSz), 0);
 480        wc_ed25519_free(&parsed);
 481
 482        /* v=0, no publicKey */
 483        XMEMCPY(tmp, privOnly, (size_t)privOnlySz);
 484        XMEMSET(&parsed, 0, sizeof(parsed));
 485        ExpectIntEQ(wc_ed25519_init(&parsed), 0);
 486        idx = 0;
 487        ExpectIntEQ(wc_Ed25519PrivateKeyDecode(tmp, &idx, &parsed,
 488            (word32)privOnlySz), 0);
 489        wc_ed25519_free(&parsed);
 490
 491        /* v=1, no publicKey */
 492        XMEMCPY(tmp, privOnly, (size_t)privOnlySz);
 493        ExpectIntGT(test_pkcs8_patch_version_byte(tmp, (word32)privOnlySz, 1),
 494            0);
 495        XMEMSET(&parsed, 0, sizeof(parsed));
 496        ExpectIntEQ(wc_ed25519_init(&parsed), 0);
 497        idx = 0;
 498        ExpectIntEQ(wc_Ed25519PrivateKeyDecode(tmp, &idx, &parsed,
 499            (word32)privOnlySz), 0);
 500        wc_ed25519_free(&parsed);
 501    }
 502
 503    wc_ed25519_free(&key);
 504    wc_FreeRng(&rng);
 505#endif
 506    return EXPECT_RESULT();
 507}
 508
 509int test_DecodeAsymKey_negative(void)
 510{
 511    EXPECT_DECLS;
 512#if defined(HAVE_ED25519) && defined(HAVE_ED25519_KEY_EXPORT) && \
 513    defined(HAVE_ED25519_KEY_IMPORT) && defined(WOLFSSL_KEY_GEN)
 514    ed25519_key key;
 515    ed25519_key parsed;
 516    WC_RNG rng;
 517    byte good[256];
 518    byte tmp[256];
 519    int  goodSz = 0;
 520    word32 idx;
 521
 522    XMEMSET(&key,    0, sizeof(key));
 523    XMEMSET(&parsed, 0, sizeof(parsed));
 524    XMEMSET(&rng,    0, sizeof(rng));
 525
 526    ExpectIntEQ(wc_InitRng(&rng), 0);
 527    ExpectIntEQ(wc_ed25519_init(&key), 0);
 528    ExpectIntEQ(wc_ed25519_make_key(&rng, ED25519_KEY_SIZE, &key), 0);
 529    ExpectIntGT(goodSz = wc_Ed25519KeyToDer(&key, good,
 530        (word32)sizeof(good)), 0);
 531
 532    if (EXPECT_SUCCESS() &&
 533        (goodSz > 0 && (size_t)goodSz <= sizeof(good))) {
 534
 535        /* Truncated buffer */
 536        XMEMCPY(tmp, good, (size_t)goodSz);
 537        ExpectIntEQ(wc_ed25519_init(&parsed), 0);
 538        idx = 0;
 539        ExpectIntLT(wc_Ed25519PrivateKeyDecode(tmp, &idx, &parsed,
 540            (word32)(goodSz - 1)), 0);
 541        wc_ed25519_free(&parsed);
 542
 543        /* Outer length too big. Patch low-order length byte (long form: bump
 544         * the last byte of the multi-byte length encoding). */
 545        XMEMCPY(tmp, good, (size_t)goodSz);
 546        if ((good[1] & 0x80) == 0) {
 547            tmp[1] = (byte)(good[1] + 1);
 548        }
 549        else {
 550            word32 nBytes = (word32)(good[1] & 0x7F);
 551            tmp[1 + nBytes] = (byte)(good[1 + nBytes] + 1);
 552        }
 553        XMEMSET(&parsed, 0, sizeof(parsed));
 554        ExpectIntEQ(wc_ed25519_init(&parsed), 0);
 555        idx = 0;
 556        ExpectIntLT(wc_Ed25519PrivateKeyDecode(tmp, &idx, &parsed,
 557            (word32)goodSz), 0);
 558        wc_ed25519_free(&parsed);
 559
 560        /* Outer tag not SEQUENCE */
 561        XMEMCPY(tmp, good, (size_t)goodSz);
 562        tmp[0] = 0x02;
 563        XMEMSET(&parsed, 0, sizeof(parsed));
 564        ExpectIntEQ(wc_ed25519_init(&parsed), 0);
 565        idx = 0;
 566        ExpectIntLT(wc_Ed25519PrivateKeyDecode(tmp, &idx, &parsed,
 567            (word32)goodSz), 0);
 568        wc_ed25519_free(&parsed);
 569    }
 570
 571    wc_ed25519_free(&key);
 572    wc_FreeRng(&rng);
 573#endif
 574    return EXPECT_RESULT();
 575}
 576
 577#ifndef NO_ASN
 578static int test_GetSetShortInt_once(word32 val, byte* valDer, word32 valDerSz)
 579{
 580    EXPECT_DECLS;
 581
 582#ifndef NO_PWDBASED
 583#if !defined(WOLFSSL_ASN_TEMPLATE) || defined(HAVE_PKCS8) || \
 584     defined(HAVE_PKCS12)
 585
 586    byte outDer[MAX_SHORT_SZ];
 587    word32 outDerSz = 0;
 588    word32 inOutIdx = 0;
 589    word32 maxIdx = MAX_SHORT_SZ;
 590    int value;
 591
 592    ExpectIntLE(2 + valDerSz, MAX_SHORT_SZ);
 593    ExpectIntEQ(outDerSz = SetShortInt(outDer, &inOutIdx, val, maxIdx),
 594        2 + valDerSz);
 595    ExpectIntEQ(outDer[0], ASN_INTEGER);
 596    ExpectIntEQ(outDer[1], valDerSz);
 597    ExpectIntEQ(XMEMCMP(outDer + 2, valDer, valDerSz), 0);
 598    if (val < 0x80000000) {
 599        /* GetShortInt only supports positive values. */
 600        inOutIdx = 0;
 601        ExpectIntEQ(val, GetShortInt(outDer, &inOutIdx, &value, maxIdx));
 602    }
 603
 604#endif /* !WOLFSSL_ASN_TEMPLATE || HAVE_PKCS8 || HAVE_PKCS12 */
 605#endif /* !NO_PWDBASED */
 606
 607    (void)val;
 608    (void)valDer;
 609    (void)valDerSz;
 610
 611    return EXPECT_RESULT();
 612}
 613#endif
 614
 615int test_GetSetShortInt(void)
 616{
 617    EXPECT_DECLS;
 618
 619#ifndef NO_ASN
 620    byte valDer[MAX_SHORT_SZ] = {0};
 621
 622    /* Corner tests for input size */
 623    {
 624        /* Input 1 byte min */
 625        valDer[0] = 0x00;
 626        EXPECT_TEST(test_GetSetShortInt_once(0x00, valDer, 1));
 627
 628        /* Input 1 byte max */
 629        valDer[0] = 0x00;
 630        valDer[1] = 0xff;
 631        EXPECT_TEST(test_GetSetShortInt_once(0xff, valDer, 2));
 632
 633        /* Input 2 bytes min */
 634        valDer[0] = 0x01;
 635        valDer[1] = 0x00;
 636        EXPECT_TEST(test_GetSetShortInt_once(0x0100, valDer, 2));
 637
 638        /* Input 2 bytes max */
 639        valDer[0] = 0x00;
 640        valDer[1] = 0xff;
 641        valDer[2] = 0xff;
 642        EXPECT_TEST(test_GetSetShortInt_once(0xffff, valDer, 3));
 643
 644        /* Input 3 bytes min */
 645        valDer[0] = 0x01;
 646        valDer[1] = 0x00;
 647        valDer[2] = 0x00;
 648        EXPECT_TEST(test_GetSetShortInt_once(0x010000, valDer, 3));
 649
 650        /* Input 3 bytes max */
 651        valDer[0] = 0x00;
 652        valDer[1] = 0xff;
 653        valDer[2] = 0xff;
 654        valDer[3] = 0xff;
 655        EXPECT_TEST(test_GetSetShortInt_once(0xffffff, valDer, 4));
 656
 657        /* Input 4 bytes min */
 658        valDer[0] = 0x01;
 659        valDer[1] = 0x00;
 660        valDer[2] = 0x00;
 661        valDer[3] = 0x00;
 662        EXPECT_TEST(test_GetSetShortInt_once(0x01000000, valDer, 4));
 663
 664        /* Input 4 bytes max */
 665        valDer[0] = 0x00;
 666        valDer[1] = 0xff;
 667        valDer[2] = 0xff;
 668        valDer[3] = 0xff;
 669        valDer[4] = 0xff;
 670        EXPECT_TEST(test_GetSetShortInt_once(0xffffffff, valDer, 5));
 671    }
 672
 673    /* Corner tests for output size */
 674    {
 675        /* Skip "Output 1 byte min" because of same as "Input 1 byte min" */
 676
 677        /* Output 1 byte max */
 678        valDer[0] = 0x7f;
 679        EXPECT_TEST(test_GetSetShortInt_once(0x7f, valDer, 1));
 680
 681        /* Output 2 bytes min */
 682        valDer[0] = 0x00;
 683        valDer[1] = 0x80;
 684        EXPECT_TEST(test_GetSetShortInt_once(0x80, valDer, 2));
 685
 686        /* Output 2 bytes max */
 687        valDer[0] = 0x7f;
 688        valDer[1] = 0xff;
 689        EXPECT_TEST(test_GetSetShortInt_once(0x7fff, valDer, 2));
 690
 691        /* Output 3 bytes min */
 692        valDer[0] = 0x00;
 693        valDer[1] = 0x80;
 694        valDer[2] = 0x00;
 695        EXPECT_TEST(test_GetSetShortInt_once(0x8000, valDer, 3));
 696
 697        /* Output 3 bytes max */
 698        valDer[0] = 0x7f;
 699        valDer[1] = 0xff;
 700        valDer[2] = 0xff;
 701        EXPECT_TEST(test_GetSetShortInt_once(0x7fffff, valDer, 3));
 702
 703        /* Output 4 bytes min */
 704        valDer[0] = 0x00;
 705        valDer[1] = 0x80;
 706        valDer[2] = 0x00;
 707        valDer[3] = 0x00;
 708        EXPECT_TEST(test_GetSetShortInt_once(0x800000, valDer, 4));
 709
 710        /* Output 4 bytes max */
 711        valDer[0] = 0x7f;
 712        valDer[1] = 0xff;
 713        valDer[2] = 0xff;
 714        valDer[3] = 0xff;
 715        EXPECT_TEST(test_GetSetShortInt_once(0x7fffffff, valDer, 4));
 716
 717        /* Output 5 bytes min */
 718        valDer[0] = 0x00;
 719        valDer[1] = 0x80;
 720        valDer[2] = 0x00;
 721        valDer[3] = 0x00;
 722        valDer[4] = 0x00;
 723        EXPECT_TEST(test_GetSetShortInt_once(0x80000000, valDer, 5));
 724
 725        /* Skip "Output 5 bytes max" because of same as "Input 4 bytes max" */
 726    }
 727
 728    /* Extra tests */
 729    {
 730        valDer[0] = 0x01;
 731        EXPECT_TEST(test_GetSetShortInt_once(0x01, valDer, 1));
 732    }
 733
 734#if !defined(NO_PWDBASED) || defined(WOLFSSL_ASN_EXTRA)
 735    /* Negative INTEGER values. */
 736    {
 737        word32 idx = 0;
 738        int value;
 739
 740        valDer[0] = ASN_INTEGER;
 741        valDer[1] = 1;
 742        valDer[2] = 0x80;
 743        ExpectIntEQ(GetShortInt(valDer, &idx, &value, 3),
 744                WC_NO_ERR_TRACE(ASN_EXPECT_0_E));
 745
 746        idx = 0;
 747        valDer[0] = ASN_INTEGER;
 748        valDer[1] = 4;
 749        valDer[2] = 0xFF;
 750        valDer[3] = 0xFF;
 751        valDer[4] = 0xFF;
 752        valDer[5] = 0xFF;
 753        ExpectIntEQ(GetShortInt(valDer, &idx, &value, 6),
 754                WC_NO_ERR_TRACE(ASN_EXPECT_0_E));
 755    }
 756
 757    #if (!defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)) || \
 758        (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2))
 759    /* zero length value. should return ASN_PARSE_E */
 760    {
 761        word32 idx = 0;
 762        int value = 0;
 763        valDer[0] = ASN_INTEGER;
 764        valDer[1] = 0x00;
 765        ExpectIntEQ(GetShortInt(valDer, &idx, &value, 2),
 766                WC_NO_ERR_TRACE(ASN_PARSE_E));
 767    }
 768    #endif /* */
 769#endif /* !NO_PWDBASED || WOLFSSL_ASN_EXTRA */
 770#endif
 771
 772    return EXPECT_RESULT();
 773}
 774
 775
 776int test_wc_IndexSequenceOf(void)
 777{
 778    EXPECT_DECLS;
 779
 780#ifndef NO_ASN
 781    const byte int_seq[] = {
 782        0x30, 0x0A,
 783        0x02, 0x01, 0x0A,
 784        0x02, 0x02, 0x00, 0xF0,
 785        0x02, 0x01, 0x7F,
 786    };
 787    const byte bad_seq[] = {
 788        0xA0, 0x01, 0x01,
 789    };
 790    const byte empty_seq[] = {
 791        0x30, 0x00,
 792    };
 793
 794    const byte * element;
 795    word32 elementSz;
 796
 797    ExpectIntEQ(wc_IndexSequenceOf(int_seq, sizeof(int_seq), 0U, &element, &elementSz), 0);
 798    ExpectPtrEq(element, &int_seq[2]);
 799    ExpectIntEQ(elementSz, 3);
 800
 801    ExpectIntEQ(wc_IndexSequenceOf(int_seq, sizeof(int_seq), 1U, &element, &elementSz), 0);
 802    ExpectPtrEq(element, &int_seq[5]);
 803    ExpectIntEQ(elementSz, 4);
 804
 805    ExpectIntEQ(wc_IndexSequenceOf(int_seq, sizeof(int_seq), 2U, &element, &elementSz), 0);
 806    ExpectPtrEq(element, &int_seq[9]);
 807    ExpectIntEQ(elementSz, 3);
 808
 809    ExpectIntEQ(wc_IndexSequenceOf(int_seq, sizeof(int_seq), 3U, &element, &elementSz), WC_NO_ERR_TRACE(BAD_INDEX_E));
 810
 811    ExpectIntEQ(wc_IndexSequenceOf(bad_seq, sizeof(bad_seq), 0U, &element, &elementSz), WC_NO_ERR_TRACE(ASN_PARSE_E));
 812
 813    ExpectIntEQ(wc_IndexSequenceOf(empty_seq, sizeof(empty_seq), 0U, &element, &elementSz), WC_NO_ERR_TRACE(BAD_INDEX_E));
 814#endif
 815
 816    return EXPECT_RESULT();
 817}
 818
 819int test_wolfssl_local_MatchBaseName(void)
 820{
 821    EXPECT_DECLS;
 822
 823#if !defined(NO_CERTS) && !defined(NO_ASN) && !defined(IGNORE_NAME_CONSTRAINTS)
 824    /*
 825     * Tests for DNS type (ASN_DNS_TYPE = 0x02)
 826     */
 827
 828    /* Positive tests - should match */
 829    /* Exact match */
 830    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 831                "domain.com", 10, "domain.com", 10), 1);
 832    /* Case insensitive match */
 833    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 834                "DOMAIN.COM", 10, "domain.com", 10), 1);
 835    /* Subdomain match (RFC 5280: adding labels to the left) */
 836    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 837                "sub.domain.com", 14, "domain.com", 10), 1);
 838    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 839                "a.b.domain.com", 14, "domain.com", 10), 1);
 840    /* Leading dot constraint with subdomain (not RFC 5280 compliant for DNS,
 841     * but kept for backwards compatibility) */
 842    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 843                "sub.domain.com", 14, ".domain.com", 11), 1);
 844    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 845                "a.b.domain.com", 14, ".domain.com", 11), 1);
 846
 847    /* Negative tests - should NOT match */
 848    /* Bug #3: fakedomain.com should NOT match domain.com (no dot boundary) */
 849    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 850                "fakedomain.com", 14, "domain.com", 10), 0);
 851    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 852                "notdomain.com", 13, "domain.com", 10), 0);
 853    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 854                "xexample.com", 12, "example.com", 11), 0);
 855    /* Bug #3: fakedomain.com should NOT match .domain.com */
 856    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 857                "fakedomain.com", 14, ".domain.com", 11), 0);
 858    /* domain.com should NOT match .domain.com (leading dot requires subdomain) */
 859    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 860                "domain.com", 10, ".domain.com", 11), 0);
 861    /* Different domain */
 862    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 863                "other.com", 9, "domain.com", 10), 0);
 864    /* Name starting with dot */
 865    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 866                ".domain.com", 11, "domain.com", 10), 0);
 867
 868    /*
 869     * Tests for email type (ASN_RFC822_TYPE = 0x01)
 870     */
 871
 872    /* Positive tests - should match */
 873    /* Exact email match */
 874    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 875                "user@domain.com", 15, "user@domain.com", 15), 1);
 876    /* Email with domain constraint (leading dot) - subdomain present */
 877    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 878                "user@sub.domain.com", 19, ".domain.com", 11), 1);
 879    /* Email with domain constraint (no leading dot) - exact domain */
 880    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 881                "user@domain.com", 15, "domain.com", 10), 1);
 882
 883    /* Negative tests - should NOT match */
 884    /* user@domain.com should NOT match .domain.com (subdomain required) */
 885    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 886                "user@domain.com", 15, ".domain.com", 11), 0);
 887    /* user@sub.domain.com should NOT match domain.com (exact domain only) */
 888    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 889                "user@sub.domain.com", 19, "domain.com", 10), 0);
 890    /* @ at start is invalid */
 891    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 892                "@domain.com", 11, ".domain.com", 11), 0);
 893    /* @ at end is invalid */
 894    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 895                "user@", 5, ".domain.com", 11), 0);
 896    /* double @ is invalid */
 897    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 898                "user@@domain.com", 16, ".domain.com", 11), 0);
 899    /* multiple @ is invalid */
 900    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 901                "user@domain@extra.com", 21, ".domain.com", 11), 0);
 902    /* No @ in email name */
 903    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 904                "userdomain.com", 14, ".domain.com", 11), 0);
 905    /* Email domain doesn't match constraint */
 906    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 907                "user@other.com", 14, ".domain.com", 11), 0);
 908    /* Email suffix without dot boundary (fakedomain) */
 909    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 910                "user@fakedomain.com", 19, ".domain.com", 11), 0);
 911    /* Base constraint with invalid @ position */
 912    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 913                "user@domain.com", 15, "@domain.com", 11), 0);
 914    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_RFC822_TYPE,
 915                "user@domain.com", 15, "user@", 5), 0);
 916
 917    /*
 918     * Tests for directory type (ASN_DIR_TYPE = 0x04)
 919     */
 920
 921    /* Positive tests - should match */
 922    /* Exact match */
 923    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DIR_TYPE,
 924                "CN=test", 7, "CN=test", 7), 1);
 925    /* Prefix match (name longer than base) */
 926    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DIR_TYPE,
 927                "CN=test,O=org", 13, "CN=test", 7), 1);
 928
 929    /* Negative tests - should NOT match */
 930    /* Different content */
 931    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DIR_TYPE,
 932                "CN=other", 8, "CN=test", 7), 0);
 933    /* Case sensitive for directory */
 934    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DIR_TYPE,
 935                "CN=TEST", 7, "CN=test", 7), 0);
 936
 937    /*
 938     * Edge cases and error handling
 939     */
 940
 941    /* NULL pointers */
 942    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 943                NULL, 10, "domain.com", 10), 0);
 944    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 945                "domain.com", 10, NULL, 10), 0);
 946    /* Empty/zero size */
 947    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 948                "", 0, "domain.com", 10), 0);
 949    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 950                "domain.com", 10, "", 0), 0);
 951    /* Invalid type */
 952    ExpectIntEQ(wolfssl_local_MatchBaseName(0xFF,
 953                "domain.com", 10, "domain.com", 10), 0);
 954    /* Name starting with dot */
 955    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 956                ".", 1, ".", 1), 0);
 957    /* Name shorter than base */
 958    ExpectIntEQ(wolfssl_local_MatchBaseName(ASN_DNS_TYPE,
 959                "a.com", 5, "domain.com", 10), 0);
 960
 961#endif /* !NO_CERTS && !NO_ASN && !IGNORE_NAME_CONSTRAINTS */
 962
 963    return EXPECT_RESULT();
 964}
 965
 966/*
 967 * Testing wc_DecodeRsaPssParams with known DER byte arrays.
 968 * Exercises both WOLFSSL_ASN_TEMPLATE and non-template paths.
 969 */
 970int test_wc_DecodeRsaPssParams(void)
 971{
 972    EXPECT_DECLS;
 973#if defined(WC_RSA_PSS) && !defined(NO_RSA) && !defined(NO_ASN)
 974    enum wc_HashType hash;
 975    int mgf;
 976    int saltLen;
 977
 978    /* SHA-256 / MGF1-SHA-256 / saltLen=32 */
 979    static const byte pssParamsSha256[] = {
 980        0x30, 0x34,
 981          0xA0, 0x0F,
 982            0x30, 0x0D,
 983              0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
 984                          0x04, 0x02, 0x01,
 985              0x05, 0x00,
 986          0xA1, 0x1C,
 987            0x30, 0x1A,
 988              0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D,
 989                          0x01, 0x01, 0x08,
 990              0x30, 0x0D,
 991                0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
 992                            0x04, 0x02, 0x01,
 993                0x05, 0x00,
 994          0xA2, 0x03,
 995            0x02, 0x01, 0x20,
 996    };
 997
 998    /* Hash-only: SHA-256 hash, defaults for MGF and salt */
 999    static const byte pssParamsHashOnly[] = {
1000        0x30, 0x11,
1001          0xA0, 0x0F,
1002            0x30, 0x0D,
1003              0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
1004                          0x04, 0x02, 0x01,
1005              0x05, 0x00,
1006    };
1007
1008    /* Salt-only: default hash/mgf, saltLen=48 */
1009    static const byte pssParamsSaltOnly[] = {
1010        0x30, 0x05,
1011          0xA2, 0x03,
1012            0x02, 0x01, 0x30,
1013    };
1014
1015    /* NULL tag (05 00) means all defaults */
1016    static const byte pssParamsNull[] = { 0x05, 0x00 };
1017
1018    /* Empty SEQUENCE means all non-default fields omitted => defaults */
1019    static const byte pssParamsEmptySeq[] = { 0x30, 0x00 };
1020
1021    /* --- Test 1: sz=0 => all defaults --- */
1022    hash = WC_HASH_TYPE_NONE;
1023    mgf = 0;
1024    saltLen = 0;
1025    ExpectIntEQ(wc_DecodeRsaPssParams((const byte*)"", 0,
1026        &hash, &mgf, &saltLen), 0);
1027    ExpectIntEQ((int)hash, (int)WC_HASH_TYPE_SHA);
1028    ExpectIntEQ(mgf, WC_MGF1SHA1);
1029    ExpectIntEQ(saltLen, 20);
1030
1031    /* --- Test 2: NULL tag => all defaults --- */
1032    hash = WC_HASH_TYPE_NONE;
1033    mgf = 0;
1034    saltLen = 0;
1035    ExpectIntEQ(wc_DecodeRsaPssParams(pssParamsNull,
1036        (word32)sizeof(pssParamsNull), &hash, &mgf, &saltLen), 0);
1037    ExpectIntEQ((int)hash, (int)WC_HASH_TYPE_SHA);
1038    ExpectIntEQ(mgf, WC_MGF1SHA1);
1039    ExpectIntEQ(saltLen, 20);
1040
1041    /* --- Test 3: Empty SEQUENCE => all defaults --- */
1042    hash = WC_HASH_TYPE_NONE;
1043    mgf = 0;
1044    saltLen = 0;
1045    ExpectIntEQ(wc_DecodeRsaPssParams(pssParamsEmptySeq,
1046        (word32)sizeof(pssParamsEmptySeq), &hash, &mgf, &saltLen), 0);
1047    ExpectIntEQ((int)hash, (int)WC_HASH_TYPE_SHA);
1048    ExpectIntEQ(mgf, WC_MGF1SHA1);
1049    ExpectIntEQ(saltLen, 20);
1050
1051#ifndef NO_SHA256
1052    /* --- Test 4: SHA-256 / MGF1-SHA-256 / salt=32 --- */
1053    hash = WC_HASH_TYPE_NONE;
1054    mgf = 0;
1055    saltLen = 0;
1056    ExpectIntEQ(wc_DecodeRsaPssParams(pssParamsSha256,
1057        (word32)sizeof(pssParamsSha256), &hash, &mgf, &saltLen), 0);
1058    ExpectIntEQ((int)hash, (int)WC_HASH_TYPE_SHA256);
1059    ExpectIntEQ(mgf, WC_MGF1SHA256);
1060    ExpectIntEQ(saltLen, 32);
1061
1062    /* --- Test 5: Hash only => SHA-256, default MGF/salt --- */
1063    hash = WC_HASH_TYPE_NONE;
1064    mgf = 0;
1065    saltLen = 0;
1066    ExpectIntEQ(wc_DecodeRsaPssParams(pssParamsHashOnly,
1067        (word32)sizeof(pssParamsHashOnly), &hash, &mgf, &saltLen), 0);
1068    ExpectIntEQ((int)hash, (int)WC_HASH_TYPE_SHA256);
1069    ExpectIntEQ(mgf, WC_MGF1SHA1);
1070    ExpectIntEQ(saltLen, 20);
1071#endif
1072
1073    /* --- Test 6: Salt only => default hash/MGF, salt=48 --- */
1074    hash = WC_HASH_TYPE_NONE;
1075    mgf = 0;
1076    saltLen = 0;
1077    ExpectIntEQ(wc_DecodeRsaPssParams(pssParamsSaltOnly,
1078        (word32)sizeof(pssParamsSaltOnly), &hash, &mgf, &saltLen), 0);
1079    ExpectIntEQ((int)hash, (int)WC_HASH_TYPE_SHA);
1080    ExpectIntEQ(mgf, WC_MGF1SHA1);
1081    ExpectIntEQ(saltLen, 48);
1082
1083    /* --- Test 7: NULL pointer -> BAD_FUNC_ARG --- */
1084    ExpectIntEQ(wc_DecodeRsaPssParams(NULL, 10, &hash, &mgf, &saltLen),
1085        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1086
1087    /* --- Test 8: Bad leading tag => ASN_PARSE_E --- */
1088    {
1089        static const byte badTag[] = { 0x01, 0x00 };
1090        ExpectIntEQ(wc_DecodeRsaPssParams(badTag, (word32)sizeof(badTag),
1091            &hash, &mgf, &saltLen), WC_NO_ERR_TRACE(ASN_PARSE_E));
1092    }
1093
1094#endif /* WC_RSA_PSS && !NO_RSA && !NO_ASN */
1095    return EXPECT_RESULT();
1096}
1097
1098/* Test that DecodeAltNames rejects a SAN entry whose length exceeds the
1099 * remaining SEQUENCE length (integer underflow on the length tracker). */
1100int test_DecodeAltNames_length_underflow(void)
1101{
1102    EXPECT_DECLS;
1103
1104#if !defined(NO_CERTS) && !defined(NO_RSA) && !defined(NO_ASN)
1105    /* Self-signed DER certificate with a well-formed SAN extension.
1106     * Byte at offset 418 is the SAN SEQUENCE length (0x06).  The negative
1107     * test below copies this cert and shrinks that byte to 0x03 so the
1108     * DNS entry length exceeds the SEQUENCE bounds. */
1109    static const unsigned char good_san_cert[] = {
1110        0x30, 0x82, 0x02, 0xf9, 0x30, 0x82, 0x01, 0xe1, 0xa0, 0x03, 0x02, 0x01,
1111        0x02, 0x02, 0x02, 0x10, 0x21, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48,
1112        0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x0f, 0x31, 0x0d,
1113        0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x04, 0x61, 0x61, 0x31,
1114        0x31, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x36, 0x30, 0x32, 0x30, 0x37, 0x31,
1115        0x37, 0x32, 0x34, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x33, 0x34, 0x30, 0x32,
1116        0x31, 0x34, 0x30, 0x36, 0x32, 0x36, 0x35, 0x33, 0x5a, 0x30, 0x0f, 0x31,
1117        0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x04, 0x61, 0x61,
1118        0x61, 0x61, 0x30, 0x82, 0x01, 0x20, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
1119        0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01,
1120        0x0d, 0x00, 0x30, 0x82, 0x01, 0x08, 0x02, 0x82, 0x01, 0x01, 0x00, 0xa8,
1121        0x8a, 0x5e, 0x26, 0x23, 0x1b, 0x31, 0xd3, 0x37, 0x1a, 0x70, 0xb2, 0xec,
1122        0x3f, 0x74, 0xd4, 0xb4, 0x44, 0xe3, 0x7a, 0xa5, 0xc0, 0xf5, 0xaa, 0x97,
1123        0x26, 0x9a, 0x04, 0xff, 0xda, 0xbe, 0xe5, 0x09, 0x03, 0x98, 0x3d, 0xb5,
1124        0xbf, 0x01, 0x2c, 0x9a, 0x0a, 0x3a, 0xfb, 0xbc, 0x3c, 0xe7, 0xbe, 0x83,
1125        0x5c, 0xb3, 0x70, 0xe8, 0x5c, 0xe3, 0xd1, 0x83, 0xc3, 0x94, 0x08, 0xcd,
1126        0x1a, 0x87, 0xe5, 0xe0, 0x5b, 0x9c, 0x5c, 0x6e, 0xb0, 0x7d, 0xe2, 0x58,
1127        0x6c, 0xc3, 0xb5, 0xc8, 0x9d, 0x11, 0xf1, 0x5d, 0x96, 0x0d, 0x66, 0x1e,
1128        0x56, 0x7f, 0x8f, 0x59, 0xa7, 0xa5, 0xe1, 0xc5, 0xe7, 0x81, 0x4c, 0x09,
1129        0x9d, 0x5e, 0x96, 0xf0, 0x9a, 0xc2, 0x8b, 0x70, 0xd5, 0xab, 0x79, 0x58,
1130        0x5d, 0xb7, 0x58, 0xaa, 0xfd, 0x75, 0x52, 0xaa, 0x4b, 0xa7, 0x25, 0x68,
1131        0x76, 0x59, 0x00, 0xee, 0x78, 0x2b, 0x91, 0xc6, 0x59, 0x91, 0x99, 0x38,
1132        0x3e, 0xa1, 0x76, 0xc3, 0xf5, 0x23, 0x6b, 0xe6, 0x07, 0xea, 0x63, 0x1c,
1133        0x97, 0x49, 0xef, 0xa0, 0xfe, 0xfd, 0x13, 0xc9, 0xa9, 0x9f, 0xc2, 0x0b,
1134        0xe6, 0x87, 0x92, 0x5b, 0xcc, 0xf5, 0x42, 0x95, 0x4a, 0xa4, 0x6d, 0x64,
1135        0xba, 0x7d, 0xce, 0xcb, 0x04, 0xd0, 0xf8, 0xe7, 0xe3, 0xda, 0x75, 0x60,
1136        0xd3, 0x8b, 0x6a, 0x64, 0xfc, 0x78, 0x56, 0x21, 0x69, 0x5a, 0xe8, 0xa7,
1137        0x8f, 0xfb, 0x8f, 0x82, 0xe3, 0xae, 0x36, 0xa2, 0x93, 0x66, 0x92, 0xcb,
1138        0x82, 0xa3, 0xbe, 0x84, 0x00, 0x86, 0xdc, 0x7e, 0x6d, 0x53, 0x77, 0x84,
1139        0x17, 0xb9, 0x55, 0x43, 0x0d, 0xf1, 0x16, 0x1f, 0xd5, 0x43, 0x75, 0x99,
1140        0x66, 0x19, 0x52, 0xd0, 0xac, 0x5f, 0x74, 0xad, 0xb2, 0x90, 0x15, 0x50,
1141        0x04, 0x74, 0x43, 0xdf, 0x6c, 0x35, 0xd0, 0xfd, 0x32, 0x37, 0xb3, 0x8d,
1142        0xf5, 0xe5, 0x09, 0x02, 0x01, 0x03, 0xa3, 0x61, 0x30, 0x5f, 0x30, 0x0c,
1143        0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00,
1144        /* SAN extension: correct SEQUENCE length 0x06 */
1145        0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x11, 0x04, 0x08, 0x30, 0x06, 0x82,
1146        0x04, 0x61, 0x2a, 0x62, 0x2a, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
1147        0x04, 0x16, 0x04, 0x14, 0x92, 0x6a, 0x1e, 0x52, 0x3a, 0x1a, 0x57, 0x9f,
1148        0xc9, 0x82, 0x9a, 0xce, 0xc8, 0xc0, 0xa9, 0x51, 0x9d, 0x2f, 0xc7, 0x72,
1149        0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80,
1150        0x14, 0x6b, 0xf9, 0xa4, 0x2d, 0xa5, 0xe9, 0x39, 0x89, 0xa8, 0x24, 0x58,
1151        0x79, 0x87, 0x11, 0xfc, 0x6f, 0x07, 0x91, 0xef, 0xa6, 0x30, 0x0d, 0x06,
1152        0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
1153        0x03, 0x82, 0x01, 0x01, 0x00, 0x3f, 0xd5, 0x37, 0x2f, 0xc7, 0xf8, 0x8b,
1154        0x39, 0x1c, 0xe3, 0xdf, 0x77, 0xee, 0xc6, 0x4b, 0x5f, 0x84, 0xcf, 0xfa,
1155        0x33, 0x2c, 0xb2, 0xb5, 0x4b, 0x09, 0xee, 0x56, 0xc0, 0xf2, 0xf0, 0xeb,
1156        0xad, 0x1c, 0x02, 0xef, 0xae, 0x09, 0x53, 0xc0, 0x06, 0xad, 0x4e, 0xfd,
1157        0x3e, 0x8c, 0x13, 0xb3, 0xbf, 0x80, 0x05, 0x36, 0xb5, 0x3f, 0x2b, 0xc7,
1158        0x60, 0x53, 0x14, 0xbf, 0x33, 0x63, 0x47, 0xc3, 0xc6, 0x28, 0xda, 0x10,
1159        0x12, 0xe2, 0xc4, 0xeb, 0xc5, 0x64, 0x66, 0xc0, 0xcc, 0x6b, 0x84, 0xda,
1160        0x0c, 0xe9, 0xf6, 0xe3, 0xf8, 0x8e, 0x3d, 0x95, 0x5f, 0xba, 0x9f, 0xe1,
1161        0xc7, 0xed, 0x6e, 0x97, 0xcc, 0xbd, 0x7d, 0xe5, 0x4e, 0xab, 0xbc, 0x1b,
1162        0xf1, 0x3a, 0x09, 0x33, 0x09, 0xe1, 0xcc, 0xec, 0x21, 0x16, 0x8e, 0xb1,
1163        0x74, 0x9e, 0xc8, 0x13, 0x7c, 0xdf, 0x07, 0xaa, 0xeb, 0x70, 0xd7, 0x91,
1164        0x5c, 0xc4, 0xef, 0x83, 0x88, 0xc3, 0xe4, 0x97, 0xfa, 0xe4, 0xdf, 0xd7,
1165        0x0d, 0xff, 0xba, 0x78, 0x22, 0xfc, 0x3f, 0xdc, 0xd8, 0x02, 0x8d, 0x93,
1166        0x57, 0xf9, 0x9e, 0x39, 0x3a, 0x77, 0x00, 0xd9, 0x19, 0xaa, 0x68, 0xa1,
1167        0xe6, 0x9e, 0x13, 0xeb, 0x37, 0x16, 0xf5, 0x77, 0xa4, 0x0b, 0x40, 0x04,
1168        0xd3, 0xa5, 0x49, 0x78, 0x35, 0xfa, 0x3b, 0xf6, 0x02, 0xab, 0x85, 0xee,
1169        0xcb, 0x9b, 0x62, 0xda, 0x05, 0x00, 0x22, 0x2f, 0xf8, 0xbd, 0x0b, 0xe5,
1170        0x2c, 0xb2, 0x53, 0x78, 0x0a, 0xcb, 0x69, 0xc0, 0xb6, 0x9f, 0x96, 0xff,
1171        0x58, 0x22, 0x70, 0x9c, 0x01, 0x2e, 0x56, 0x60, 0x5d, 0x37, 0xe3, 0x40,
1172        0x25, 0xc9, 0x90, 0xc8, 0x0f, 0x41, 0x68, 0xb4, 0xfd, 0x10, 0xe2, 0x09,
1173        0x99, 0x08, 0x5d, 0x7b, 0xc9, 0xe3, 0x29, 0xd4, 0x5a, 0xcf, 0xc9, 0x34,
1174        0x55, 0xa1, 0x40, 0x44, 0xd6, 0x88, 0x16, 0xbb, 0xdd
1175    };
1176
1177    /* Offset of the SAN SEQUENCE length byte inside good_san_cert. */
1178    #define SAN_SEQ_LEN_OFFSET 418
1179
1180    DecodedCert cert;
1181    unsigned char bad_san_cert[sizeof(good_san_cert)];
1182
1183    /* Control: the original cert with correct SAN SEQUENCE length should
1184     * parse successfully (signature won't verify, but NO_VERIFY skips that). */
1185    wc_InitDecodedCert(&cert, good_san_cert, (word32)sizeof(good_san_cert),
1186        NULL);
1187    ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL), 0);
1188    wc_FreeDecodedCert(&cert);
1189
1190    /* Build a malformed variant: shrink the SAN SEQUENCE length from 6 to 3
1191     * so the DNS entry length (4) exceeds the SEQUENCE bounds.  Without a
1192     * bounds check DecodeAltNames would underflow the length tracker. */
1193    XMEMCPY(bad_san_cert, good_san_cert, sizeof(good_san_cert));
1194    bad_san_cert[SAN_SEQ_LEN_OFFSET] = 0x03;
1195
1196    wc_InitDecodedCert(&cert, bad_san_cert, (word32)sizeof(bad_san_cert),
1197        NULL);
1198    ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
1199        WC_NO_ERR_TRACE(ASN_PARSE_E));
1200    wc_FreeDecodedCert(&cert);
1201
1202    /* NUL in dNSName SAN must be rejected per RFC 5280 4.2.1.6. */
1203    XMEMCPY(bad_san_cert, good_san_cert, sizeof(good_san_cert));
1204    bad_san_cert[SAN_SEQ_LEN_OFFSET + 5] = 0x00;
1205
1206    wc_InitDecodedCert(&cert, bad_san_cert, (word32)sizeof(bad_san_cert),
1207        NULL);
1208    ExpectIntEQ(wc_ParseCert(&cert, CERT_TYPE, NO_VERIFY, NULL),
1209        WC_NO_ERR_TRACE(ASN_PARSE_E));
1210    wc_FreeDecodedCert(&cert);
1211
1212#endif /* !NO_CERTS && !NO_RSA && !NO_ASN */
1213    return EXPECT_RESULT();
1214}
1215
1216int test_SerialNumber0_RootCA(void)
1217{
1218    EXPECT_DECLS;
1219
1220#if !defined(NO_CERTS) && !defined(NO_FILESYSTEM) && !defined(NO_RSA) && \
1221    !defined(WOLFSSL_NO_PEM) && defined(WOLFSSL_PEM_TO_DER)
1222    /* Test that root CA certificates with serial number 0 are accepted,
1223     * while non-root certificates with serial 0 are rejected (issue #8615) */
1224
1225#if !defined(WOLFSSL_NO_ASN_STRICT) && !defined(WOLFSSL_PYTHON) && \
1226    !defined(WOLFSSL_ASN_ALLOW_0_SERIAL) && \
1227    !defined(WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION)
1228    WOLFSSL_CERT_MANAGER* cm = NULL;
1229    const char* rootSerial0File = "./certs/test-serial0/root_serial0.pem";
1230    const char* selfSignedNonCASerial0File =
1231        "./certs/test-serial0/selfsigned_nonca_serial0.pem";
1232
1233    /* Test 1: Root CA with serial 0 should load successfully */
1234    ExpectNotNull(cm = wolfSSL_CertManagerNew());
1235    ExpectIntEQ(wolfSSL_CertManagerLoadCA(cm, rootSerial0File, NULL),
1236                WOLFSSL_SUCCESS);
1237
1238#if (!defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH)) || \
1239    defined(OPENSSL_EXTRA)
1240    {
1241        const char* eeSerial0File = "./certs/test-serial0/ee_serial0.pem";
1242        const char* eeNormalFile = "./certs/test-serial0/ee_normal.pem";
1243
1244        /* Test 2: End-entity cert with serial 0 should be rejected during
1245         * verify */
1246        ExpectIntEQ(wolfSSL_CertManagerVerify(cm, eeSerial0File,
1247                    WOLFSSL_FILETYPE_PEM), WC_NO_ERR_TRACE(ASN_PARSE_E));
1248
1249        /* Test 3: Normal end-entity cert signed by root CA with serial 0
1250         * should verify successfully */
1251        ExpectIntEQ(wolfSSL_CertManagerVerify(cm, eeNormalFile,
1252                    WOLFSSL_FILETYPE_PEM), WOLFSSL_SUCCESS);
1253    }
1254#endif
1255
1256    if (cm != NULL) {
1257        wolfSSL_CertManagerFree(cm);
1258        cm = NULL;
1259    }
1260
1261    /* Test 4: Self-signed non-CA certificate with serial 0 should be rejected */
1262    ExpectNotNull(cm = wolfSSL_CertManagerNew());
1263    ExpectIntNE(wolfSSL_CertManagerLoadCA(cm, selfSignedNonCASerial0File, NULL),
1264                WOLFSSL_SUCCESS);
1265
1266    if (cm != NULL) {
1267        wolfSSL_CertManagerFree(cm);
1268        cm = NULL;
1269    }
1270
1271    /* Test 5: Intermediate CA (CA:TRUE but issuer != subject) with serial 0
1272     * must be rejected when loaded as CA_TYPE. Exercises the selfSigned
1273     * half of the ParseCertRelative exemption predicate. */
1274    {
1275        const char* intermediateSerial0File =
1276            "./certs/test-serial0/intermediate_serial0.pem";
1277        ExpectNotNull(cm = wolfSSL_CertManagerNew());
1278        ExpectIntNE(wolfSSL_CertManagerLoadCA(cm, intermediateSerial0File,
1279                    NULL), WOLFSSL_SUCCESS);
1280        if (cm != NULL) {
1281            wolfSSL_CertManagerFree(cm);
1282            cm = NULL;
1283        }
1284    }
1285#endif /* !WOLFSSL_NO_ASN_STRICT && !WOLFSSL_PYTHON &&
1286          !WOLFSSL_ASN_ALLOW_0_SERIAL &&
1287          !WOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION */
1288#endif /* !NO_CERTS && !NO_FILESYSTEM && !NO_RSA && !WOLFSSL_NO_PEM */
1289
1290    return EXPECT_RESULT();
1291}
1292
1293int test_wc_DecodeObjectId(void)
1294{
1295    EXPECT_DECLS;
1296
1297#if !defined(NO_ASN) && \
1298    (defined(HAVE_OID_DECODING) || defined(WOLFSSL_ASN_PRINT))
1299    {
1300        /* OID 1.2.840.113549.1.1.11 (sha256WithRSAEncryption)
1301         * DER encoding: 2a 86 48 86 f7 0d 01 01 0b
1302         * First byte 0x2a = 42 => arc0 = 42/40 = 1, arc1 = 42%40 = 2
1303         * Remaining arcs: 840, 113549, 1, 1, 11
1304         */
1305        static const byte oid_sha256rsa[] = {
1306            0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b
1307        };
1308        word16 out[MAX_OID_SZ];
1309        word32 outSz;
1310
1311        /* Test 1: Normal decode */
1312        outSz = MAX_OID_SZ;
1313        ExpectIntEQ(DecodeObjectId(oid_sha256rsa, sizeof(oid_sha256rsa),
1314                                   out, &outSz), 0);
1315        ExpectIntEQ((int)outSz, 7);
1316        ExpectIntEQ(out[0], 1);
1317        ExpectIntEQ(out[1], 2);
1318        ExpectIntEQ(out[2], 840);
1319        ExpectIntEQ(out[3], (word16)113549); /* truncated to word16 */
1320        ExpectIntEQ(out[4], 1);
1321        ExpectIntEQ(out[5], 1);
1322        ExpectIntEQ(out[6], 11);
1323
1324        /* Test 2: NULL args */
1325        outSz = MAX_OID_SZ;
1326        ExpectIntEQ(DecodeObjectId(NULL, sizeof(oid_sha256rsa), out, &outSz),
1327                    WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1328        ExpectIntEQ(DecodeObjectId(oid_sha256rsa, sizeof(oid_sha256rsa),
1329                                   out, NULL),
1330                    WC_NO_ERR_TRACE(BAD_FUNC_ARG));
1331
1332        /* Test 3 (Bug 1): outSz=1 must return BUFFER_E, not OOB write.
1333         * The first OID byte decodes into two arcs, so outSz must be >= 2. */
1334        outSz = 1;
1335        ExpectIntEQ(DecodeObjectId(oid_sha256rsa, sizeof(oid_sha256rsa),
1336                                   out, &outSz),
1337                    WC_NO_ERR_TRACE(BUFFER_E));
1338
1339        /* Test 4: outSz=0 must also return BUFFER_E */
1340        outSz = 0;
1341        ExpectIntEQ(DecodeObjectId(oid_sha256rsa, sizeof(oid_sha256rsa),
1342                                   out, &outSz),
1343                    WC_NO_ERR_TRACE(BUFFER_E));
1344
1345        /* Test 5: outSz=2 is enough for a single-byte OID (two arcs) */
1346        {
1347            static const byte oid_one_byte[] = { 0x2a }; /* 1.2 */
1348            outSz = 2;
1349            ExpectIntEQ(DecodeObjectId(oid_one_byte, sizeof(oid_one_byte),
1350                                       out, &outSz), 0);
1351            ExpectIntEQ((int)outSz, 2);
1352            ExpectIntEQ(out[0], 1);
1353            ExpectIntEQ(out[1], 2);
1354        }
1355
1356        /* Test 6: Buffer too small for later arcs */
1357        outSz = 3; /* only room for 3 arcs, but OID has 7 */
1358        ExpectIntEQ(DecodeObjectId(oid_sha256rsa, sizeof(oid_sha256rsa),
1359                                   out, &outSz),
1360                    WC_NO_ERR_TRACE(BUFFER_E));
1361    }
1362#endif /* !NO_ASN && (HAVE_OID_DECODING || WOLFSSL_ASN_PRINT) */
1363
1364    return EXPECT_RESULT();
1365}