[ohki-saito]

Description

Fenrir #8866

wolfSSL_DES_cbc_cksum() accepted length == 0 when all pointer arguments were non-NULL. In that case dataSz stays 0, and copying the last block reads from tmp + (dataSz - DES_BLOCK_SIZE), which is 8 bytes before the temporary buffer. On allocators that return a non-NULL pointer for a zero-byte allocation, this is an out-of-bounds read that can crash or return an arbitrary checksum. Negative lengths were also not rejected.

Changes:

• Reject length <= 0 as a bad argument and return 0.
• Add tests calling DES_cbc_cksum with valid pointers and a length of 0 and -1.

Fixes zd#

Testing

Added tests calling DES_cbc_cksum with valid pointers and a length of 0 and -1, which must return 0.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Copilot]

🟢 Approval recommended

The targeted guard prevents invalid-length processing, regression tests cover both reported cases, and no blocking issues remain.

No open issues 🎉

What changed in this PR

This PR prevents an out-of-bounds read in wolfSSL_DES_cbc_cksum() by rejecting non-positive input lengths. It also corrects compression API documentation.

Changes:

• Reject zero and negative checksum lengths before processing.
• Add regression tests for lengths 0 and -1 with valid pointers.
• Correct compression error codes, example error checks, and window-format guidance.

File	Description
tests/​api/​test_ossl_cipher.c	Tests rejection of zero and negative checksum lengths.
src/​ssl_crypto.c	Adds non-positive length validation to the DES checksum function.
doc/​dox_comments/​header_files/​compress.h	Corrects compression API documentation and examples.

_{Review effort: Balanced}