[yosuke-wolfssl]

Problem

On ppc64le builds with --enable-ppc64-asm, wc_Sha256Transform() returns the wrong chaining state on every call. The API takes the block as host-order 32-bit words. The PPC64 asm (Transform_Sha256_Len) loads each word with lwbrx on little-endian because it expects a big-endian byte stream, which is what Sha256Update() and Sha256Final() pass. wc_Sha256Transform() handed the host-order block straight to the asm, so every message word was byte-swapped. The ARM/RISC-V arm of the function already converts the block first.

Fix (wolfcrypt/src/sha256.c)

The existing ByteReverseWords() local-buffer branch of wc_Sha256Transform() now also covers WOLFSSL_PPC64_ASM && LITTLE_ENDIAN_ORDER. The asm then receives the same byte stream that Update gives it. The buffer is still ForceZero()ed.

Closes f-17179.

Tests

No new tests. The existing known-answer tests test_wc_Sha256Transform and test_wolfSSL_SHA256_Transform already cover this. They failed on ppc64le before the fix, but no CI job builds the PPC64 asm.

Verification

Configure: --enable-ppc64-asm --enable-opensslextra --disable-shared, run under qemu-user.

Target	Before	After
ppc64le POWER10/9/8, both Transform tests	fail (wrong digest)	pass
ppc64le, sha256 API group + testwolfcrypt	n/a	pass
ppc64 BE POWER8, both Transform tests	pass	pass
macOS arm64, both Transform tests	pass	pass

[Copilot]

🟢 Approval recommended

No active review issues block approval of the little-endian PPC64 SHA-256 byte-order fix.

No open issues 🎉

What changed in this PR

Fixes incorrect SHA-256 chaining states from wc_Sha256Transform() on little-endian PPC64 assembly builds by converting host-order input words to the byte order expected by the assembly implementation.

Changes:

• Extends the existing byte-reversal buffer path to little-endian PPC64 assembly builds.
• Reuses existing buffer clearing and leaves big-endian PPC64 behavior unchanged.

File	Description
wolfcrypt/​src/​sha256.c	Adds little-endian PPC64 assembly to the input byte-reversal condition in wc_Sha256Transform().

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,584 B (+0.6%, 284,032 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[yosuke-wolfssl]

@claude review

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11987

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite