[kaleb-himes]

Description

sha512: SHA-512/224 FinalRaw and Transform no longer modify state or input
Sha512FinalRaw: for SHA-512/224 (28-byte digest, not a multiple of 8) the
little-endian path byte-reversed sha512->digest in place before copying it
out, so wc_Sha512_224FinalRaw() corrupted the running hash. Any Update after
FinalRaw then produced the wrong digest. It now reverses into a local copy,
which is zeroized after use, as the other FinalRaw paths already do.

wc_Sha512Transform: on little-endian builds (generic C without AVX, ARM,
RISC-V, PPC) the function byte-reversed the caller's const data block in
place. The block is now copied or reversed into the existing scratch buffer
or sha->buffer instead, so the transform receives the same input on every
path and the caller's buffer is left unchanged.

Testing

Tests:

• test_wc_Sha512Transform: checks the caller's block is unchanged after
  Transform.
• test_wc_Sha512_224FinalRaw: hashes "ab", reads FinalRaw, hashes "c", and
  checks the result is SHA-512/224("abc") from the FIPS 180-4 examples.

Verified (non-FIPS, --enable-opensslextra): both tests fail with master's
sha512.c (test_sha512.c:278 and :358) and pass with this change; make check
passes.

ppc64le Transform double byte-reversal is open as Fenrir F-17178 and is not
part of this fix.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the SHA-512 state and input preservation changes.

No open issues 🎉

What changed in this PR

This PR fixes unintended state and input mutation in wolfCrypt’s SHA-512 APIs.

Changes:

• Preserve SHA-512/224 hash state during FinalRaw by byte-reversing a temporary copy and zeroizing it afterward.
• Use internal buffers in wc_Sha512Transform to leave the caller’s input unchanged.
• Add regression tests for input preservation and continued hashing after FinalRaw.

File	Description
wolfcrypt/​src/​sha512.c	Prevents mutation of hash state and caller input during raw digest and transform operations.
tests/​api/​test_sha512.c	Adds regression checks for both mutation bugs.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 313,040 B / 1,048,576 B, total: 30% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,584 B (+0.6%, 284,032 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11983

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite