F-2376 - https://fenrir.wolfssl.com/finding/2376 - Fix C_Digest single-shot NULL size query checking wrong parameter

Author: aidangarske

src/internal.c

@@ -14233,7 +14233,7 @@ int WP11_Digest_Single(unsigned char* data, word32 dataLen,
 
     blockLen = wc_HashGetDigestSize(digest->hashType);
 
-    if (data == NULL) {
+    if (dataOut == NULL) {
         *dataOutLen = (word32)blockLen;
         return CKR_OK;
     }

tests/pkcs11test.c

@@ -5289,6 +5289,48 @@ static CK_RV test_digest_fail(void* args)
     return ret;
 }
 
+#ifndef NO_SHA256
+static CK_RV test_digest_single_size_query(void* args)
+{
+    CK_SESSION_HANDLE session = *(CK_SESSION_HANDLE*)args;
+    CK_RV ret;
+    CK_MECHANISM mech;
+    byte data[32], hash[32];
+    CK_ULONG dataSz = sizeof(data);
+    CK_ULONG hashSz = 0;
+
+    XMEMSET(data, 0x42, sizeof(data));
+    mech.mechanism = CKM_SHA256;
+    mech.ulParameterLen = 0;
+    mech.pParameter = NULL;
+
+    /* C_Digest with pDigest=NULL should return size without computing */
+    ret = funcList->C_DigestInit(session, &mech);
+    CHECK_CKR(ret, "Digest Init for size query");
+    if (ret == CKR_OK) {
+        hashSz = 0;
+        ret = funcList->C_Digest(session, data, dataSz, NULL, &hashSz);
+        CHECK_CKR(ret, "C_Digest size query with pDigest=NULL");
+    }
+    if (ret == CKR_OK && hashSz != 32) {
+        ret = -1;
+        CHECK_CKR(ret, "C_Digest size query should return 32 for SHA-256");
+    }
+    /* Now actually compute with properly sized buffer */
+    if (ret == CKR_OK) {
+        hashSz = sizeof(hash);
+        ret = funcList->C_Digest(session, data, dataSz, hash, &hashSz);
+        CHECK_CKR(ret, "C_Digest compute");
+    }
+    if (ret == CKR_OK && hashSz != 32) {
+        ret = -1;
+        CHECK_CKR(ret, "C_Digest output should be 32 for SHA-256");
+    }
+
+    return ret;
+}
+#endif
+
 static CK_RV test_sign_verify(void* args)
 {
     CK_SESSION_HANDLE session = *(CK_SESSION_HANDLE*)args;
@@ -17233,6 +17275,9 @@ static TEST_FUNC testFunc[] = {
     PKCS11TEST_FUNC_SESS_DECL(test_encrypt_decrypt_op_not_supported),
 #endif
     PKCS11TEST_FUNC_SESS_DECL(test_digest_fail),
+#ifndef NO_SHA256
+    PKCS11TEST_FUNC_SESS_DECL(test_digest_single_size_query),
+#endif
     PKCS11TEST_FUNC_SESS_DECL(test_sign_verify),
     PKCS11TEST_FUNC_SESS_DECL(test_sign_verify_op_not_supported),
     PKCS11TEST_FUNC_SESS_DECL(test_recover),