Mcdc test coverage: part 5

CMakeLists.txt

@@ -4396,6 +4396,8 @@ if(WOLFSSL_EXAMPLES)
         tests/api/test_random.c
         tests/api/test_wolfentropy.c
         tests/api/test_wolfevent.c
+        tests/api/test_port.c
+        tests/api/test_compress.c
         tests/api/test_wolfmath.c
         tests/api/test_rsa.c
         tests/api/test_dsa.c

tests/api.c

@@ -237,6 +237,8 @@
 #include <tests/api/test_random.h>
 #include <tests/api/test_wolfentropy.h>
 #include <tests/api/test_wolfevent.h>
+#include <tests/api/test_port.h>
+#include <tests/api/test_compress.h>
 #include <tests/api/test_wolfmath.h>
 #include <tests/api/test_rsa.h>
 #include <tests/api/test_dsa.h>
@@ -38603,6 +38605,8 @@ TEST_CASE testCases[] = {
     TEST_RANDOM_DECLS,
     TEST_WOLFENTROPY_DECLS,
     TEST_WOLFEVENT_DECLS,
+    TEST_PORT_DECLS,
+    TEST_COMPRESS_DECLS,
 
     /* Public key */
     /* wolfmath MP API tests */
@@ -39397,13 +39401,13 @@ TEST_CASE testCases[] = {
     TEST_DECL(test_wolfSSL_read_ahead_ctx_inherit),
     TEST_DECL(test_wolfSSL_inject),
     TEST_DECL(test_ocsp_status_callback),
-    TEST_DECL(test_ocsp_basic_verify),
-    TEST_DECL(test_ocsp_ancestor_responder_rejected),
-    TEST_DECL(test_ocsp_responder_keyhash_binding),
-    TEST_DECL(test_ocsp_response_parsing),
-    TEST_DECL(test_ocsp_certid_enc_dec),
-    TEST_DECL(test_ocsp_certid_dup),
-    TEST_DECL(test_ocsp_resp_find_status_serial_prefix),
+    TEST_DECL_GROUP("ocsp", test_ocsp_basic_verify),
+    TEST_DECL_GROUP("ocsp", test_ocsp_ancestor_responder_rejected),
+    TEST_DECL_GROUP("ocsp", test_ocsp_responder_keyhash_binding),
+    TEST_DECL_GROUP("ocsp", test_ocsp_response_parsing),
+    TEST_DECL_GROUP("ocsp", test_ocsp_certid_enc_dec),
+    TEST_DECL_GROUP("ocsp", test_ocsp_certid_dup),
+    TEST_DECL_GROUP("ocsp", test_ocsp_resp_find_status_serial_prefix),
     TEST_DECL(test_ocsp_tls_cert_cb),
     TEST_DECL(test_ocsp_status_request_v2_multi_revoked_single),
     TEST_DECL(test_ocsp_cert_unknown_crl_fallback),

tests/api/include.am

@@ -44,6 +44,8 @@ tests_unit_test_SOURCES += tests/api/test_error.c
 tests_unit_test_SOURCES += tests/api/test_random.c
 tests_unit_test_SOURCES += tests/api/test_wolfentropy.c
 tests_unit_test_SOURCES += tests/api/test_wolfevent.c
+tests_unit_test_SOURCES += tests/api/test_port.c
+tests_unit_test_SOURCES += tests/api/test_compress.c
 # MP
 tests_unit_test_SOURCES += tests/api/test_wolfmath.c
 # Public Key Algorithm
@@ -174,6 +176,8 @@ EXTRA_DIST += tests/api/test_error.h
 EXTRA_DIST += tests/api/test_random.h
 EXTRA_DIST += tests/api/test_wolfentropy.h
 EXTRA_DIST += tests/api/test_wolfevent.h
+EXTRA_DIST += tests/api/test_port.h
+EXTRA_DIST += tests/api/test_compress.h
 EXTRA_DIST += tests/api/test_wolfmath.h
 EXTRA_DIST += tests/api/test_rsa.h
 EXTRA_DIST += tests/api/test_dsa.h

tests/api/test_compress.c

@@ -0,0 +1,115 @@
+/* test_compress.c
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#include <tests/unit.h>
+
+/* After <tests/unit.h>: that header establishes wolfSSL's feature-test
+ * macros, and a libc header pulled in ahead of it fixes glibc's exposure
+ * before they are seen -- under -std=c89 that leaves POSIX types the rest of
+ * the suite needs undeclared. Every other file in tests/api/ starts with
+ * <tests/unit.h> for the same reason. INT_MAX is used below. */
+#include <limits.h>
+
+#ifdef HAVE_LIBZ
+    #include <wolfssl/wolfcrypt/compress.h>
+#endif
+#include <wolfssl/wolfcrypt/error-crypt.h>
+#include <tests/api/api.h>
+#include <tests/api/test_compress.h>
+
+/*
+ * MC/DC decision coverage for the zlib wrapper (wolfcrypt/src/compress.c).
+ * compress_test() in testwolfcrypt exercises the round trips; this drives the
+ * argument guards, each operand flipped independently:
+ *   - "out == NULL || in == NULL" in wc_Compress_ex, wc_DeCompress_ex and
+ *     wc_DeCompressDynamic;
+ *   - "inSz == 0 || inSz > INT_MAX/2" in wc_DeCompressDynamic, the cap that
+ *     keeps the buffer doubling from overflowing.
+ */
+int test_wc_CompressDecisionCoverage(void)
+{
+    EXPECT_DECLS;
+#ifdef HAVE_LIBZ
+    static const byte sample[] =
+        "wolfSSL compress decision coverage sample text, repeated enough to "
+        "actually compress: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    byte  packed[512];
+    byte  plain[512];
+    byte* dynOut = NULL;
+    int   packedSz;
+
+    XMEMSET(packed, 0, sizeof(packed));
+    XMEMSET(plain, 0, sizeof(plain));
+
+    /* wc_Compress_ex "out == NULL || in == NULL" */
+    ExpectIntEQ(wc_Compress_ex(NULL, sizeof(packed), sample, sizeof(sample),
+        0, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_Compress_ex(packed, sizeof(packed), NULL, sizeof(sample),
+        0, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    /* both operands false: a real compression, whose output feeds the
+     * decompression guards below. */
+    ExpectIntGT(packedSz = wc_Compress(packed, sizeof(packed), sample,
+        sizeof(sample), 0), 0);
+
+    /* wc_DeCompress_ex "out == NULL || in == NULL" */
+    ExpectIntEQ(wc_DeCompress_ex(NULL, sizeof(plain), packed, sizeof(packed),
+        0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_DeCompress_ex(plain, sizeof(plain), NULL, sizeof(packed),
+        0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    if (EXPECT_SUCCESS() && packedSz > 0) {
+        ExpectIntEQ(wc_DeCompress(plain, sizeof(plain), packed,
+            (word32)packedSz), (int)sizeof(sample));
+        ExpectIntEQ(XMEMCMP(plain, sample, sizeof(sample)), 0);
+    }
+
+    /* wc_DeCompressDynamic "out == NULL || in == NULL" */
+    ExpectIntEQ(wc_DeCompressDynamic(NULL, 1, DYNAMIC_TYPE_TMP_BUFFER, packed,
+        (word32)packedSz, 0, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_DeCompressDynamic(&dynOut, 1, DYNAMIC_TYPE_TMP_BUFFER, NULL,
+        (word32)packedSz, 0, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    /* wc_DeCompressDynamic "inSz == 0 || inSz > INT_MAX/2", one operand true
+     * per call, then both false on the working round trip. */
+    ExpectIntEQ(wc_DeCompressDynamic(&dynOut, 1, DYNAMIC_TYPE_TMP_BUFFER,
+        packed, 0, 0, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_DeCompressDynamic(&dynOut, 1, DYNAMIC_TYPE_TMP_BUFFER,
+        packed, (word32)(INT_MAX / 2) + 1, 0, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    if (EXPECT_SUCCESS() && packedSz > 0) {
+        ExpectIntEQ(wc_DeCompressDynamic(&dynOut, 4, DYNAMIC_TYPE_TMP_BUFFER,
+            packed, (word32)packedSz, 0, NULL),
+            (int)sizeof(sample));
+        ExpectNotNull(dynOut);
+        if (dynOut != NULL) {
+            ExpectIntEQ(XMEMCMP(dynOut, sample, sizeof(sample)), 0);
+            XFREE(dynOut, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            dynOut = NULL;
+        }
+    }
+#endif /* HAVE_LIBZ */
+    return EXPECT_RESULT();
+}

tests/api/test_compress.h

@@ -0,0 +1,32 @@
+/* test_compress.h
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#ifndef WOLFCRYPT_TEST_COMPRESS_H
+#define WOLFCRYPT_TEST_COMPRESS_H
+
+#include <tests/api/api_decl.h>
+
+int test_wc_CompressDecisionCoverage(void);
+
+#define TEST_COMPRESS_DECLS                                                    \
+    TEST_DECL_GROUP("compress", test_wc_CompressDecisionCoverage)
+
+#endif /* WOLFCRYPT_TEST_COMPRESS_H */

tests/api/test_pkcs12.c

@@ -1080,3 +1080,62 @@ int test_wc_PKCS12_PBKDF_ex_sha512_256(void)
 #endif
     return EXPECT_RESULT();
 }
+
+/*
+ * MC/DC decision coverage for the PKCS#12 container API
+ * (wolfcrypt/src/pkcs12.c). The pkcs12 group's other tests are almost all
+ * wc_PKCS12_PBKDF_ex, which lives in pwdbased.c, so the container entry points
+ * are otherwise reached only by the pkcs12_test() KAT. This drives their
+ * multi-operand argument guards, each operand flipped independently.
+ */
+int test_wc_PKCS12DecisionCoverage(void)
+{
+    EXPECT_DECLS;
+#if defined(HAVE_PKCS12) && !defined(NO_ASN) && !defined(NO_PWDBASED) && \
+    !defined(NO_HMAC) && !defined(NO_CERTS)
+    WC_PKCS12* pkcs12 = NULL;
+    byte  der[8];
+    byte* out = NULL;
+    int   outSz = 0;
+
+    XMEMSET(der, 0, sizeof(der));
+
+    ExpectNotNull(pkcs12 = wc_PKCS12_new());
+
+    /* wc_d2i_PKCS12 "der == NULL || pkcs12 == NULL" */
+    ExpectIntEQ(wc_d2i_PKCS12(NULL, sizeof(der), pkcs12),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_d2i_PKCS12(der, sizeof(der), NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    /* both operands false: rejected by the parser, not the argument check */
+    ExpectIntNE(wc_d2i_PKCS12(der, sizeof(der), pkcs12),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    /* wc_i2d_PKCS12 argument guards; a container with no safe/signData
+     * exercises the "pkcs12->safe == NULL" half of the cascade. */
+    ExpectIntLT(wc_i2d_PKCS12(NULL, &out, &outSz), 0);
+    ExpectIntLT(wc_i2d_PKCS12(pkcs12, NULL, &outSz), 0);
+    ExpectIntLT(wc_i2d_PKCS12(pkcs12, &out, NULL), 0);
+
+    /* wc_PKCS12_parse on an empty container: the pkcs12 != NULL operand is
+     * false while the internal state operands decide the outcome. */
+    {
+        byte* pkey = NULL; word32 pkeySz = 0;
+        byte* cert = NULL; word32 certSz = 0;
+        WC_DerCertList* ca = NULL;
+
+        ExpectIntLT(wc_PKCS12_parse(NULL, "pw", &pkey, &pkeySz, &cert, &certSz,
+            &ca), 0);
+        ExpectIntLT(wc_PKCS12_parse(pkcs12, "pw", &pkey, &pkeySz, &cert,
+            &certSz, &ca), 0);
+        if (pkey != NULL) XFREE(pkey, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
+        if (cert != NULL) XFREE(cert, NULL, DYNAMIC_TYPE_PKCS);
+        if (ca != NULL) wc_FreeCertList(ca, NULL);
+    }
+
+    wc_PKCS12_free(pkcs12);
+    /* wc_PKCS12_free tolerates NULL: the guard's true half. */
+    wc_PKCS12_free(NULL);
+#endif /* HAVE_PKCS12 && ... */
+    return EXPECT_RESULT();
+}

tests/api/test_pkcs12.h

@@ -40,6 +40,7 @@ int test_wc_PKCS12_PBKDF_ex_sha224(void);
 int test_wc_PKCS12_PBKDF_ex_sha384(void);
 int test_wc_PKCS12_PBKDF_ex_sha512_224(void);
 int test_wc_PKCS12_PBKDF_ex_sha512_256(void);
+int test_wc_PKCS12DecisionCoverage(void);
 
 #define TEST_PKCS12_DECLS                                               \
     TEST_DECL_GROUP("pkcs12", test_wc_i2d_PKCS12),                     \
@@ -57,6 +58,7 @@ int test_wc_PKCS12_PBKDF_ex_sha512_256(void);
     TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF_ex_sha224),         \
     TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF_ex_sha384),         \
     TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF_ex_sha512_224),     \
-    TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF_ex_sha512_256)
+    TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF_ex_sha512_256),     \
+    TEST_DECL_GROUP("pkcs12", test_wc_PKCS12DecisionCoverage)
 
 #endif /* WOLFCRYPT_TEST_PKCS12_H */