nxp hashcrypt: validate AES ECB/CBC args and zero-length

[night1rider]

Reject NULL aes/in/out with BAD_FUNC_ARG and return early on zero length before key setup and the sz-16 IV copy, matching wc_AesCtrEncrypt.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11261

Scan targets checked: wolfcrypt-port-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[night1rider]

jenkins retest this please

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Copilot]

Pull request overview

This PR updates the NXP HASHCRYPT AES port implementation to behave more defensively, aligning ECB/CBC argument handling with other wolfCrypt AES mode implementations (notably returning early on sz == 0 and rejecting NULL pointers).

Changes:

• Added NULL argument validation (aes, in, out) for AES ECB encrypt/decrypt.
• Added NULL argument validation (aes, in, out) for AES CBC encrypt/decrypt.
• Added early return on sz == 0 for ECB/CBC to avoid unnecessary key setup and CBC IV copying.

Suppressed comments (3)

wolfcrypt/src/port/nxp/hashcrypt_port.c:244

• ECB mode requires sz to be a multiple of the AES block size. Without validating this, callers can pass a non-block-multiple size and get a generic WC_HW_E instead of BAD_LENGTH_E, and behavior depends on the HAL implementation.

    if (sz == 0)
        return 0;

    ret = _hashcrypt_set_key(aes);

wolfcrypt/src/port/nxp/hashcrypt_port.c:268

• CBC mode requires sz to be a multiple of the AES block size. Without a block-size check, XMEMCPY(aes->reg, out + sz - 16, 16) can underflow when sz < 16 and cause out-of-bounds reads/writes.

    if (sz == 0)
        return 0;

    ret = _hashcrypt_set_key(aes);

wolfcrypt/src/port/nxp/hashcrypt_port.c:294

• CBC mode requires sz to be a multiple of the AES block size. Without validating this, XMEMCPY(tmp_iv, in + sz - 16, 16) can read before the start of in when sz < 16, causing out-of-bounds access.

    if (sz == 0)
        return 0;

    ret = _hashcrypt_set_key(aes);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.