F-5037: reject negative key length in PKCS12 PBKDF JNI wrapper

Author: cconlon

jni/jni_pwdbased.c

@@ -52,7 +52,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PKCS12_1PBK
     jbyteArray result = NULL;
     (void)jcl;
 
-    if (env == NULL || kLen == 0) {
+    if (env == NULL || kLen <= 0) {
         throwWolfCryptExceptionFromError(env, BAD_FUNC_ARG);
         return NULL;
     }
@@ -147,7 +147,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PBKDF2
     jbyteArray result = NULL;
     (void)jcl;
 
-    if (env == NULL || kLen == 0) {
+    if (env == NULL || kLen <= 0) {
         throwWolfCryptExceptionFromError(env, BAD_FUNC_ARG);
         return NULL;
     }

src/test/java/com/wolfssl/wolfcrypt/test/PwdbasedTest.java

@@ -134,4 +134,52 @@ public void testPkcs12PbkdfDoesNotModifyPassword() {
         assertArrayEquals("PKCS12_PBKDF modified caller password array",
             passCopy, pass);
     }
+
+    /**
+     * PBKDF2 must reject zero/negative key lengths with BAD_FUNC_ARG.
+     */
+    @Test
+    public void testPbkdf2RejectsNonPositiveKeyLength() {
+
+        Assume.assumeTrue("PBKDF2 not compiled in native wolfSSL",
+            FeatureDetect.Pbkdf2Enabled());
+
+        byte[] pass = makePassword();
+        byte[] salt = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
+
+        for (int kLen : new int[] {-1, 0}) {
+            try {
+                Pwdbased.PBKDF2(pass, salt, 100, kLen,
+                    WolfCrypt.WC_HASH_TYPE_SHA256);
+                fail("PBKDF2 should reject kLen: " + kLen);
+            } catch (WolfCryptException e) {
+                assertEquals("kLen " + kLen + " must map to BAD_FUNC_ARG",
+                    WolfCryptError.BAD_FUNC_ARG, e.getError());
+            }
+        }
+    }
+
+    /**
+     * PKCS12 PBKDF must reject zero/negative key lengths with BAD_FUNC_ARG.
+     */
+    @Test
+    public void testPkcs12PbkdfRejectsNonPositiveKeyLength() {
+
+        byte[] pass = makePassword();
+        byte[] salt = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
+
+        for (int kLen : new int[] {-1, 0}) {
+            try {
+                Pwdbased.PKCS12_PBKDF(pass, salt, 100, kLen,
+                    WolfCrypt.WC_HASH_TYPE_SHA256, 1);
+                fail("PKCS12_PBKDF should reject kLen: " + kLen);
+            } catch (WolfCryptException e) {
+                Assume.assumeTrue(
+                    "PKCS12 PBKDF not compiled in native wolfSSL",
+                    e.getError() != WolfCryptError.NOT_COMPILED_IN);
+                assertEquals("kLen " + kLen + " must map to BAD_FUNC_ARG",
+                    WolfCryptError.BAD_FUNC_ARG, e.getError());
+            }
+        }
+    }
 }