Port stack buffer overflow regression tests to python

Ports the regression tests added in ec1c1e5 (Merge PR #212, F 569: Fix
stack buffer overflow in encryption setup) from enc-test.sh to the
python enc-test.py. Covers both the AES/EVP inName path and the
Camellia non-EVP outNameEnc/outNameDec paths for:

- Filename supplied via stdin when -in/-out is omitted
- Empty-line reprompt after invalid input
- Long-input flush (255 chars) after overflow attempt

Author: julek-wolfssl

tests/encrypt/enc-test.py

@@ -275,5 +275,181 @@ def test_legacy_aes_cbc_128_roundtrip(self):
                         "legacy aes-cbc-128 round trip failed")
 
 
+def _camellia_available():
+    """Check if Camellia support is enabled in the wolfssl binary."""
+    crl = os.path.join(CERTS_DIR, "crl.der")
+    if not os.path.isfile(crl):
+        return False
+    probe = "test-cam-probe.enc"
+    try:
+        r = run_enc("enc", "-camellia-128-cbc", "-in", crl, "-out", probe,
+                    password="testpass")
+        return r.returncode == 0
+    finally:
+        if os.path.exists(probe):
+            os.remove(probe)
+
+
+class EncStdinInputTest(unittest.TestCase):
+    """Regression tests for stack buffer overflow fix (scanf -> fgets).
+
+    When -in or -out is omitted, wolfCLU prompts for the filename on stdin.
+    These tests exercise the fgets-based input paths, including the
+    empty-line re-prompt and the too-long-input flush branches.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        if not os.path.isdir(CERTS_DIR):
+            raise unittest.SkipTest("certs directory not found")
+
+        config_log = os.path.join(".", "config.log")
+        if os.path.isfile(config_log):
+            with open(config_log, "r") as f:
+                if "disable-filesystem" in f.read():
+                    raise unittest.SkipTest("filesystem support disabled")
+
+        cls.has_camellia = _camellia_available()
+
+    def _cleanup(self, *files):
+        for f in files:
+            self.addCleanup(lambda p=f: os.remove(p)
+                            if os.path.exists(p) else None)
+
+    def _run_enc_stdin(self, stdin_data, *args, password="testpass"):
+        """Run wolfssl enc with stdin input (for filename prompts)."""
+        cmd = [WOLFSSL_BIN, "enc"] + list(args) + ["-k", password]
+        return subprocess.run(cmd, input=stdin_data,
+                              capture_output=True, text=True, timeout=60)
+
+    # -- AES (EVP path) --
+
+    def test_aes_inname_via_stdin(self):
+        """-in omitted; filename supplied via stdin (inName path)."""
+        enc = "test-stdin-in.enc"
+        dec = "test-stdin-in.dec"
+        orig = os.path.join(CERTS_DIR, "crl.der")
+        self._cleanup(enc, dec)
+
+        r = self._run_enc_stdin(f"{orig}\n", "-aes-128-cbc", "-out", enc)
+        self.assertEqual(r.returncode, 0,
+                         f"enc with stdin input failed: {r.stderr}")
+
+        r = run_enc("enc", "-d", "-aes-128-cbc", "-in", enc, "-out", dec,
+                    password="testpass")
+        self.assertEqual(r.returncode, 0, r.stderr)
+        self.assertTrue(filecmp.cmp(orig, dec, shallow=False),
+                        "stdin enc/dec roundtrip mismatch")
+
+    def test_aes_inname_empty_line_reprompt(self):
+        """Empty line on stdin is rejected; next valid filename accepted."""
+        enc = "test-empty-in.enc"
+        dec = "test-empty-in.dec"
+        orig = os.path.join(CERTS_DIR, "crl.der")
+        self._cleanup(enc, dec)
+
+        r = self._run_enc_stdin(f"\n{orig}\n", "-aes-128-cbc", "-out", enc)
+        self.assertEqual(r.returncode, 0,
+                         f"enc should accept filename after empty line: "
+                         f"{r.stderr}")
+
+        r = run_enc("enc", "-d", "-aes-128-cbc", "-in", enc, "-out", dec,
+                    password="testpass")
+        self.assertEqual(r.returncode, 0, r.stderr)
+        self.assertTrue(filecmp.cmp(orig, dec, shallow=False),
+                        "enc/dec roundtrip mismatch after empty-line reprompt")
+
+    def test_aes_inname_too_long_reprompt(self):
+        """Overlong input is flushed; next valid filename accepted."""
+        enc = "test-toolong-in.enc"
+        dec = "test-toolong-in.dec"
+        orig = os.path.join(CERTS_DIR, "crl.der")
+        self._cleanup(enc, dec)
+
+        long_input = " " * 255
+        r = self._run_enc_stdin(f"{long_input}\n{orig}\n",
+                                "-aes-128-cbc", "-out", enc)
+        self.assertEqual(r.returncode, 0,
+                         f"enc should recover after too-long input: "
+                         f"{r.stderr}")
+
+        r = run_enc("enc", "-d", "-aes-128-cbc", "-in", enc, "-out", dec,
+                    password="testpass")
+        self.assertEqual(r.returncode, 0, r.stderr)
+        self.assertTrue(filecmp.cmp(orig, dec, shallow=False),
+                        "enc/dec roundtrip mismatch after too-long reprompt")
+
+    # -- Camellia (non-EVP path) --
+
+    def test_camellia_outname_via_stdin(self):
+        """-out omitted; output filename supplied via stdin (non-EVP path)."""
+        if not self.has_camellia:
+            self.skipTest("Camellia not available")
+        enc = "test-cam-stdin.enc"
+        dec = "test-cam-stdin.dec"
+        orig = os.path.join(CERTS_DIR, "crl.der")
+        self._cleanup(enc, dec)
+
+        r = self._run_enc_stdin(f"{enc}\n", "-camellia-128-cbc", "-in", orig)
+        self.assertEqual(r.returncode, 0,
+                         f"Camellia enc with stdin output name failed: "
+                         f"{r.stderr}")
+
+        r = self._run_enc_stdin(f"{dec}\n", "-d", "-camellia-128-cbc",
+                                "-in", enc)
+        self.assertEqual(r.returncode, 0,
+                         f"Camellia dec with stdin output name failed: "
+                         f"{r.stderr}")
+        self.assertTrue(filecmp.cmp(orig, dec, shallow=False),
+                        "Camellia stdin outName roundtrip mismatch")
+
+    def test_camellia_outname_empty_line_reprompt(self):
+        """Empty line rejected; next valid output name accepted (non-EVP)."""
+        if not self.has_camellia:
+            self.skipTest("Camellia not available")
+        enc = "test-cam-empty.enc"
+        dec = "test-cam-empty.dec"
+        orig = os.path.join(CERTS_DIR, "crl.der")
+        self._cleanup(enc, dec)
+
+        r = self._run_enc_stdin(f"\n{enc}\n", "-camellia-128-cbc", "-in", orig)
+        self.assertEqual(r.returncode, 0,
+                         f"Camellia enc should accept output name after "
+                         f"empty line: {r.stderr}")
+
+        r = self._run_enc_stdin(f"\n{dec}\n", "-d", "-camellia-128-cbc",
+                                "-in", enc)
+        self.assertEqual(r.returncode, 0,
+                         f"Camellia dec should accept output name after "
+                         f"empty line: {r.stderr}")
+        self.assertTrue(filecmp.cmp(orig, dec, shallow=False),
+                        "Camellia roundtrip mismatch after empty-line "
+                        "reprompt")
+
+    def test_camellia_outname_too_long_reprompt(self):
+        """Overlong input flushed; next valid output name accepted (non-EVP)."""
+        if not self.has_camellia:
+            self.skipTest("Camellia not available")
+        enc = "test-cam-toolong.enc"
+        dec = "test-cam-toolong.dec"
+        orig = os.path.join(CERTS_DIR, "crl.der")
+        self._cleanup(enc, dec)
+
+        long_input = " " * 255
+        r = self._run_enc_stdin(f"{long_input}\n{enc}\n",
+                                "-camellia-128-cbc", "-in", orig)
+        self.assertEqual(r.returncode, 0,
+                         f"Camellia enc should recover after too-long output "
+                         f"name: {r.stderr}")
+
+        r = self._run_enc_stdin(f"{long_input}\n{dec}\n",
+                                "-d", "-camellia-128-cbc", "-in", enc)
+        self.assertEqual(r.returncode, 0,
+                         f"Camellia dec should recover after too-long output "
+                         f"name: {r.stderr}")
+        self.assertTrue(filecmp.cmp(orig, dec, shallow=False),
+                        "Camellia roundtrip mismatch after too-long reprompt")
+
+
 if __name__ == "__main__":
     test_main()