Fix silent key truncation on short BIO_write in key encoders - #481
Merged
Conversation
The key encoders write DER/PEM output with a single BIO_write and treat any positive return as success, so a short write silently truncates the encoding. Add a deterministic test that encodes an EC public key through a BIO that accepts one byte per write and confirms no bytes are lost. Fenrir 11560.
BIO_write may write fewer bytes than requested. The key encoders checked only for a non-positive return, so a short write truncated the DER/PEM output while still reporting success. Add wp_write_bio, which loops until all bytes are written, and use it in the RSA, ECC, ECX, DH and ML-DSA encoders. Fenrir 11560.
wolfSSL-Fenrir-bot
previously requested changes
Aug 28, 2026
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #481
Scan targets checked: wolfprovider-bugs, wolfprovider-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
The regression test was registered under WP_HAVE_EC_P256 but defined and declared under WP_HAVE_ECDH && WP_HAVE_EC_P256, so a P-256 build without HAVE_ECC_DHE failed to compile. Move the test, its helper, and the sink BIO out of the WP_HAVE_ECDH blocks so all three sites match.
sameehj
requested review from
aidangarske,
padelsbach and
wolfSSL-Fenrir-bot
September 1, 2026 16:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR body
BIO_writeis allowed to write fewer bytes than requested (a "short write"),which returns a positive value smaller than
keyLen. The old check onlyrejected
rc <= 0, so a short write was reported as success while the DER/PEMoutput was silently truncated. Application-supplied BIOs (sockets, pipes,
non-blocking or custom sinks) can legitimately short-write, so a caller could
receive and persist a corrupt, incomplete key with no error.
Fix
Add a shared helper
wp_write_bio()insrc/wp_internal.cthat loops untilevery byte is written, and use it in all five encoders. The helper mirrors the
existing
wp_read_der_biostyle (WOLFPROV_ENTER/LEAVE,okflag, Doxygenheader). Each iteration either advances past the bytes written or fails, so
there is no busy-loop or hang.
Encoder sinks are used synchronously, so a non-positive return is treated as a
hard failure rather than spinning on
BIO_should_retry— it fails closedinstead of truncating.
Testing
New deterministic regression test
test_ecc_encode_short_write_bio(unit case143). It builds a custom BIO that accepts exactly one byte per write, encodes a
P-256 key as DER and PEM
SubjectPublicKeyInfothrough it, and asserts thecaptured bytes equal the full reference encoding from
OSSL_ENCODER_to_data.No threads or timing — binary pass/fail.
Before/after (case number:
./test/unit.test --list | grep short_write):./test/unit.test 143fails withShort write truncated output: 1 of 91 bytes../test/unit.test 143passes for DER and PEM.Fenrir
Addresses Fenrir finding 11560 (short-write truncation in key encoders).