Return NOT_COMPILED_IN from wc_BufferKey{Encrypt,Decrypt} for unknown cipherType

[holtrop-wolfssl]

Description

Return NOT_COMPILED_IN from wc_BufferKey{Encrypt,Decrypt} for unknown cipherType

Fixes F-7397

Testing

How did you test?

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR fixes wc_BufferKeyEncrypt() / wc_BufferKeyDecrypt() so that an unhandled info->cipherType no longer returns success after a successful PBKDF1 step, instead correctly returning NOT_COMPILED_IN. It also adds API tests to lock in the behavior for an enum value that is valid but intentionally not dispatched by these functions.

Changes:

• Preserve the default ret = NOT_COMPILED_IN by avoiding reuse of ret for the PBKDF1 return code in wc_BufferKey{Encrypt,Decrypt}.
• Add an API test that asserts an unknown/unhandled cipherType returns NOT_COMPILED_IN for both encrypt and decrypt paths.
• Register the new test in the API test decl header.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
wolfcrypt/src/wc_encrypt.c	Keeps ret at NOT_COMPILED_IN unless a supported cipher dispatch arm runs (prevents false success on unknown cipher).
tests/api/test_wc_encrypt.h	Registers the new unknown-cipher test in the API test list.
tests/api/test_wc_encrypt.c	Adds coverage ensuring unknown/unhandled cipherType returns NOT_COMPILED_IN.

Suppressed comments (1)

wolfcrypt/src/wc_encrypt.c:293

• On PBKDF1 failure, key may contain partially-derived sensitive material (see wc_PBKDF1_ex() writing to key before later hash errors). The early-return path should explicitly zero key before freeing/checking it to avoid leaving key material in memory and to prevent wc_MemZero_Check() from aborting if key was modified before the error.

    if ((pbkdf1_ret = wc_PBKDF1(key, password, passwordSz, info->iv, PKCS5_SALT_SZ, 1,
                                        (int)info->keySz, hashType)) != 0) {
#ifdef WOLFSSL_SMALL_STACK
        XFREE(key, NULL, DYNAMIC_TYPE_SYMMETRIC_KEY);
#elif defined(WOLFSSL_CHECK_MEM_ZERO)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[holtrop-wolfssl]

retest this please (fips ready config failed in PRB-master-job)