From 300270241fb73990e044d5f1d79f99c1063996e1 Mon Sep 17 00:00:00 2001 From: Andrew Hutchings Date: Tue, 20 Oct 2026 15:08:41 +0100 Subject: [PATCH] Fix -Wshorten-64-to-32 in the PKCS#11 ML-DSA callbacks Pkcs11GetMldsaPublicKey passes the CK_ULONG public key size to wc_MlDsaKey_ImportPubRaw, and the ML-DSA sign callback stores the CK_ULONG signature length in a word32, both without a cast. clang reports them with -Wshorten-64-to-32, which the debug build enables, so a git checkout configured with --enable-pkcs11 --enable-mldsa --enable-debug fails to build under -Werror. Cast both, as the ML-KEM and RSA code in this file does. The public key size has already been matched against the ML-DSA key sizes, and C_Sign returns at most the buffer length it was given. --- wolfcrypt/src/wc_pkcs11.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/wolfcrypt/src/wc_pkcs11.c b/wolfcrypt/src/wc_pkcs11.c index ccb7c95eab2..ff2597ec691 100644 --- a/wolfcrypt/src/wc_pkcs11.c +++ b/wolfcrypt/src/wc_pkcs11.c @@ -4919,7 +4919,7 @@ static int Pkcs11GetMldsaPublicKey(wc_MlDsaKey* key, ret = WC_KEY_SIZE_E; } if (ret == 0) - ret = wc_MlDsaKey_ImportPubRaw(key, pubKey, pubKeySize); + ret = wc_MlDsaKey_ImportPubRaw(key, pubKey, (word32)pubKeySize); if (pubKey != NULL) XFREE(pubKey, key->heap, DYNAMIC_TYPE_TMP_BUFFER); @@ -5231,7 +5231,7 @@ static int Pkcs11MldsaSign(Pkcs11Session* session, wc_CryptoInfo* info) } if (ret == 0) { - *info->pk.pqc_sign.outlen = outLen; + *info->pk.pqc_sign.outlen = (word32)outLen; } if (sessionKey)