From 5311a6e220fa288fb40339851a543acd723472d1 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 12 Mar 2026 11:32:51 +0000 Subject: [PATCH] Updated mbedtls_ccm_finish_boundary to handle zero len tags Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ccm.data | 8 ++++++++ tests/suites/test_suite_ccm.function | 18 ++++++++++++++---- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_ccm.data b/tests/suites/test_suite_ccm.data index e03406ca4b..b1930de50f 100644 --- a/tests/suites/test_suite_ccm.data +++ b/tests/suites/test_suite_ccm.data @@ -1762,6 +1762,14 @@ CCM finish check-boundary decrypt tag_len=8, finish_tag_len=8 depends_on:MBEDTLS_CCM_GCM_CAN_AES mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:8:0 +CCM finish check-boundary encrypt tag_len=0, finish_tag_len=0 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:0:0:MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED + +CCM finish check-boundary decrypt tag_len=0, finish_tag_len=0 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:0:0:MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED + # CCM finish boundary matrix (encrypt) CCM finish check-boundary encrypt tag_len=16, finish_tag_len=16 depends_on:MBEDTLS_CCM_GCM_CAN_AES diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function index 251eb350d4..dd4302209a 100644 --- a/tests/suites/test_suite_ccm.function +++ b/tests/suites/test_suite_ccm.function @@ -925,11 +925,21 @@ void mbedtls_ccm_finish_boundary(int cipher_id, int mode, BLOCK_CIPHER_PSA_INIT(); TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key, sizeof(key) * 8), 0); - TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv, sizeof(iv))); - /* Use the caller-provided tag length during setup, then finish with a - * different tag length to exercise boundary handling/API compliance */ - TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); + + /* For non-CCM* with tag_len=0, validate the mbedtls_ccm_set_lengths path + * when ccm_calculate_first_block_if_ready() fails. */ + if (start_tag_len == 0) { + TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); + TEST_EQUAL(MBEDTLS_ERR_CCM_BAD_INPUT, + mbedtls_ccm_starts(&ctx, mode, iv, sizeof(iv))); + + /* Use the caller-provided tag length during setup, then finish with a + * different tag length to exercise boundary handling/API compliance */ + } else { + TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv, sizeof(iv))); + TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); + } TEST_CALLOC(tag, finish_tag_len); TEST_EQUAL(expected_finish_ret,