From 7ed69f7f66bff96d6f40d81bb4b7d2b293e6a8b6 Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Tue, 13 Oct 2026 16:12:12 -0600
Subject: [PATCH] JCE: throw SignatureException from
 WolfCryptSignature.engineSign() on native sign errors

---
 .../provider/jce/WolfCryptSignature.java      |  4 +++
 .../jce/test/WolfCryptSignatureTest.java      | 36 +++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/src/main/java/com/wolfssl/provider/jce/WolfCryptSignature.java b/src/main/java/com/wolfssl/provider/jce/WolfCryptSignature.java
index 2017c7b88..a5383e98e 100644
--- a/src/main/java/com/wolfssl/provider/jce/WolfCryptSignature.java
+++ b/src/main/java/com/wolfssl/provider/jce/WolfCryptSignature.java
@@ -816,6 +816,10 @@ protected synchronized byte[] engineSign() throws SignatureException {
                         "Invalid signature algorithm type");
             }
 
+        } catch (WolfCryptException e) {
+            throw new SignatureException(keyTypeToString(this.keyType) +
+                " sign failed: " + e.getMessage(), e);
+
         } finally {
             /* Zeroize message digest and DER encoding before refs drop */
             zeroArray(digest);
diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java
index 1f3400f8b..22818310e 100644
--- a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java
+++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java
@@ -66,6 +66,7 @@
 import com.wolfssl.wolfcrypt.Rsa;
 import com.wolfssl.wolfcrypt.Fips;
 import com.wolfssl.wolfcrypt.FeatureDetect;
+import com.wolfssl.wolfcrypt.WolfCryptException;
 import com.wolfssl.provider.jce.WolfCryptProvider;
 import com.wolfssl.wolfcrypt.test.TimedTestWatcher;
 
@@ -2205,6 +2206,41 @@ public void testRsaPssRejectsUnsupportedMgf1Digest()
         }
     }
 
+    @Test
+    public void testRsaPssSignNativeErrorThrowsSignatureException()
+        throws Exception {
+
+        if (!enabledAlgos.contains("RSASSA-PSS") ||
+            !com.wolfssl.wolfcrypt.FeatureDetect.RsaPssEnabled()) {
+            /* Skip if RSA-PSS not enabled at JCE or native level */
+            return;
+        }
+
+        byte[] toSignBuf = "Everyone gets Friday off.".getBytes();
+
+        KeyPair pair = rsaPair;
+        assertNotNull(pair);
+
+        /* Salt as long as the modulus, native sign rejects on all builds */
+        int saltLen =
+            ((RSAKey)pair.getPrivate()).getModulus().bitLength() / 8;
+
+        Signature signer = Signature.getInstance("RSASSA-PSS", "wolfJCE");
+        signer.setParameter(new PSSParameterSpec("SHA-256", "MGF1",
+            MGF1ParameterSpec.SHA256, saltLen, 1));
+        signer.initSign(pair.getPrivate());
+        signer.update(toSignBuf, 0, toSignBuf.length);
+
+        try {
+            signer.sign();
+            fail("Should throw SignatureException on native sign error");
+
+        } catch (SignatureException e) {
+            assertTrue("Native error should be preserved as cause",
+                e.getCause() instanceof WolfCryptException);
+        }
+    }
+
     @Test
     public void testRsaPssMultipleUpdates()
         throws Exception {