From 7aee0419ead7b34ee399daba8958241fcf1cb4cd Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Wed, 29 Jul 2026 15:47:25 +0200 Subject: [PATCH] tests: skip single-DES NULL-arg MC/DC under FIPS/selftest (SIGSEGV) test_wc_Des_CbcEncryptDecrypt drove the per-operand NULL guards of wc_Des_CbcEncrypt/CbcDecrypt/EcbEncrypt/SetIV. The frozen FIPS/selftest single-DES module predates those open-build NULL checks and dereferences a NULL des/out/in directly, so the probes segfault (exit 139) in a FIPS build. Gate the whole test on !HAVE_FIPS && !HAVE_SELFTEST -- this single-DES MC/DC coverage is gathered in the open build; the frozen module is out of its scope. --- tests/api/test_des3.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/api/test_des3.c b/tests/api/test_des3.c index 7bd09ea2b2..81faff205e 100644 --- a/tests/api/test_des3.c +++ b/tests/api/test_des3.c @@ -302,7 +302,12 @@ int test_wc_Des3_EcbEncrypt(void) int test_wc_Des_CbcEncryptDecrypt(void) { EXPECT_DECLS; -#ifndef NO_DES3 +/* The frozen FIPS/selftest single-DES module does not NULL-check its arguments + * (the open-build guards these tests exercise were added post-freeze), so the + * per-operand NULL probes below dereference NULL and crash under HAVE_FIPS / + * HAVE_SELFTEST. This single-DES MC/DC coverage is gathered in the open build; + * skip it on the frozen modules. */ +#if !defined(NO_DES3) && !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) Des des; byte cipher[DES_BLOCK_SIZE]; byte plain[DES_BLOCK_SIZE];