misc: reject a negative length in ConstantCompare() by stenslae · Pull Request #11561 · wolfSSL/wolfssl

stenslae · 2026-09-25T19:36:53Z

Description

ConstantCompare() and wc_ConstantCompare() returned 0 (equal) for a negative length, so a caller whose length arithmetic underflowed got a false match. They now return 1. length == 0 still returns 0.

The value is positive because callers such as AES_GCM_decrypt_C() build constant-time masks that read a negative value as a match.

Adds constantcompare_test() to wolfCrypt's test suite.

Checklist

added tests
updated/added doxygen
updated appropriate READMEs
Updated manual and documentation

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11561

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 3 in-scope changed file(s) opened by the reviewer; not opened: wolfcrypt/test/test.c, wolfssl/wolfcrypt/memory.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

github-actions · 2026-09-25T19:48:45Z

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

FLASH: .text +16 B (+0.0%, 70,475 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

FLASH: .text +16 B (+0.0%, 130,785 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-openssl-compat

FLASH: .text +64 B (+0.0%, 796,268 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pkcs7

FLASH: .text -64 B (-0.0%, 223,552 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-rsa-only

FLASH: .text -64 B (-0.0%, 343,064 B / 1,048,576 B, total: 33% used)

stm32-sim-stm32h753

FLASH: .text +576 B (+0.3%, 206,296 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

FLASH: log_const_area -8 B, rodata +68 B, text +440 B (+0.2%, 282,964 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

stenslae · 2026-09-28T16:41:43Z

Jenkins retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11561

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11561

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 5 of 10 in-scope changed file(s) opened by the reviewer; not opened: wolfcrypt/src/blake2b.c, wolfcrypt/src/blake2s.c, wolfcrypt/src/memory.c, wolfssl/wolfcrypt/blake2-impl.h, wolfssl/wolfcrypt/memory.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

philljj · 2026-09-30T15:36:58Z

This PR is also moving ForceZero to wc_port:

harden forcezero and compiler barriers #10935

Copilot

Copilot review overview

🔵 Needs a closer look

Secure wiping and compiler-barrier changes span toolchains and architectures that need platform-level validation.

Review effort: Balanced
Findings: 1

Open (1)

Expand PR scope description or separate unrelated changes · New

What changed in this PR

This PR fixes negative-length comparisons in wolfCrypt. It also changes secure wiping and compiler barriers across supported platforms.

Changes:

Return a positive result for negative comparison lengths and add tests.
Revise secure wiping, compiler barriers, and the location of exported helper functions.
Update feature guards and release notes.

File	Description
`wolfssl/wolfcrypt/wc_port.h`	Declares helpers and revises barrier macros.
`wolfssl/wolfcrypt/settings.h`	Preserves wiping for BLAKE2 and Argon2.
`wolfssl/wolfcrypt/memory.h`	Removes relocated helper declarations.
`wolfssl/wolfcrypt/blake2-impl.h`	Removes the old wiping helper.
`wolfcrypt/test/test.h`	Declares the comparison test.
`wolfcrypt/test/test.c`	Tests comparison results and boundaries.
`wolfcrypt/src/wc_port.c`	Houses exported helpers and the portable barrier sink.
`wolfcrypt/src/misc.c`	Rejects negative lengths and revises wiping.
`wolfcrypt/src/memory.c`	Removes relocated helper implementations.
`wolfcrypt/src/blake2s.c`	Uses `ForceZero` for key material.
`wolfcrypt/src/blake2b.c`	Uses `ForceZero` for key material.
`ChangeLog.md`	Records behavioral and compatibility changes.
`.wolfssl_known_macro_extras`	Registers the new barrier macro.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

stenslae · 2026-09-30T15:46:47Z

This pr is branched off of #10935

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11561

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Copilot

🟡 Changes recommended

Positive-length mismatches can still return negative on supported wide-byte targets, violating the new contract.

1 open finding

Prevent signed overflow from misclassifying positive comparison results · New

2 resolved since last review

🧠 Review effort: Balanced

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11561

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Copilot

🔵 Needs a closer look

Security-sensitive erasure and inline-assembly changes span numerous supported compiler and architecture combinations requiring human validation.

0 open findings

1 resolved since last review

Prevent signed overflow from misclassifying positive comparison results

🧠 Review effort: Balanced

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11561

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 3 in-scope changed file(s) opened by the reviewer; not opened: wolfcrypt/test/test.c, wolfssl/wolfcrypt/wc_port.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

philljj

Why does this PR need to branch off #10935 if it's only fixing ConstantCompare?

Please keep PRs small and modular.

stenslae · 2026-10-28T21:42:30Z

Removed ConstantCompare()'s base from ForceZero.

Returning 0 for a negative length reported "equal" for a comparison that never ran. The sentinel is positive because AES_GCM_decrypt_C() folds this return into a mask that reads a negative value as a match.

stenslae · 2026-10-28T21:53:47Z

@claude review

Copilot

🟢 Approval recommended

No active review issues were identified for the constant-time comparison hardening change.

No open issues 🎉

_{Review effort: Balanced}

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11561

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): ChangeLog.md, wolfcrypt/test/test.h
Coverage: 4 of 4 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

claude

Code review found no issues

No high-confidence issues detected in this change.

stenslae requested a review from wolfSSL-Fenrir-bot September 25, 2026 19:36

stenslae self-assigned this Sep 25, 2026

wolfSSL-Fenrir-bot reviewed Sep 25, 2026

View reviewed changes

stenslae force-pushed the fix/wc-ConstantCompare branch 2 times, most recently from 8f994e9 to 7e9d1ae Compare September 25, 2026 20:19

stenslae assigned wolfSSL-Bot and unassigned stenslae Sep 25, 2026

stenslae force-pushed the fix/wc-ConstantCompare branch from 7e9d1ae to 6fd42cf Compare September 28, 2026 17:47

stenslae requested a review from wolfSSL-Fenrir-bot September 28, 2026 17:49

wolfSSL-Fenrir-bot previously requested changes Sep 28, 2026

View reviewed changes

Comment thread wolfcrypt/test/test.c Outdated

stenslae force-pushed the fix/wc-ConstantCompare branch from 6fd42cf to 4690a0d Compare September 28, 2026 18:25

stenslae requested a review from wolfSSL-Fenrir-bot September 28, 2026 18:27

wolfSSL-Fenrir-bot reviewed Sep 28, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings September 30, 2026 15:35

stenslae force-pushed the fix/wc-ConstantCompare branch from 4690a0d to 8da59b5 Compare September 30, 2026 15:35

Copilot started reviewing on behalf of stenslae September 30, 2026 15:37

View session

philljj mentioned this pull request Sep 30, 2026

harden forcezero and compiler barriers #10935

Open

1 of 4 tasks

philljj assigned stenslae and unassigned wolfSSL-Bot Sep 30, 2026

Copilot AI reviewed Sep 30, 2026

View reviewed changes

Comment thread ChangeLog.md Outdated

philljj requested a review from douzzer September 30, 2026 15:49

philljj assigned douzzer Sep 30, 2026

stenslae force-pushed the fix/wc-ConstantCompare branch 2 times, most recently from fec73b0 to 6c8bc3e Compare October 12, 2026 16:34

stenslae requested a review from wolfSSL-Fenrir-bot October 12, 2026 16:34

wolfSSL-Fenrir-bot reviewed Oct 12, 2026

View reviewed changes

stenslae force-pushed the fix/wc-ConstantCompare branch from 3441191 to 709a9c0 Compare October 12, 2026 19:55

stenslae requested review from wolfSSL-Fenrir-bot and a balanced review from Copilot October 12, 2026 19:55

Copilot started reviewing on behalf of stenslae October 12, 2026 19:56

View session

Copilot AI reviewed Oct 12, 2026

View reviewed changes

Comment thread wolfcrypt/src/misc.c Outdated

wolfSSL-Fenrir-bot reviewed Oct 12, 2026

View reviewed changes

stenslae force-pushed the fix/wc-ConstantCompare branch from 709a9c0 to c889b3c Compare October 12, 2026 20:10

stenslae requested review from wolfSSL-Fenrir-bot and a balanced review from Copilot October 12, 2026 20:10

Copilot started reviewing on behalf of stenslae October 12, 2026 20:11

View session

Copilot AI reviewed Oct 12, 2026

View reviewed changes

wolfSSL-Fenrir-bot reviewed Oct 12, 2026

View reviewed changes

stenslae removed their assignment Oct 12, 2026

stenslae force-pushed the fix/wc-ConstantCompare branch from c889b3c to 4451775 Compare October 23, 2026 19:22

philljj requested changes Oct 23, 2026

View reviewed changes

philljj assigned stenslae and unassigned douzzer Oct 23, 2026

misc: reject a negative length in ConstantCompare()

5651758

Returning 0 for a negative length reported "equal" for a comparison that never ran. The sentinel is positive because AES_GCM_decrypt_C() folds this return into a mask that reads a negative value as a match.

stenslae force-pushed the fix/wc-ConstantCompare branch from 4451775 to 5651758 Compare October 28, 2026 21:51

stenslae requested review from wolfSSL-Fenrir-bot and a balanced review from Copilot October 28, 2026 21:51

Copilot started reviewing on behalf of stenslae October 28, 2026 21:52

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

wolfSSL-Fenrir-bot reviewed Oct 28, 2026

View reviewed changes

claude Bot reviewed Oct 28, 2026

View reviewed changes

stenslae assigned wolfSSL-Bot and unassigned stenslae Oct 28, 2026

Conversation

stenslae commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11561

Uh oh!

github-actions Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

gcc-arm-cortex-m3

gcc-arm-cortex-m4-openssl-compat

gcc-arm-cortex-m4-pkcs7

gcc-arm-cortex-m4-rsa-only

stm32-sim-stm32h753

zephyr-frdm_rw612

Uh oh!

stenslae commented Sep 28, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11561

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11561

Uh oh!

philljj commented Sep 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Uh oh!

stenslae commented Sep 30, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11561

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11561

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11561

Uh oh!

philljj left a comment

Choose a reason for hiding this comment

Uh oh!

stenslae commented Oct 28, 2026

Uh oh!

stenslae commented Oct 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11561

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

stenslae commented Sep 25, 2026 •

edited

Loading

github-actions Bot commented Sep 25, 2026 •

edited

Loading