From 63528e7ccfb7c74d82bac23d8a5fed1a4c77847f Mon Sep 17 00:00:00 2001
From: Paul Adelsbach <paul.adelsbach@wolfssl.com>
Date: Fri, 6 Mar 2026 11:58:28 -0800
Subject: [PATCH] Various checks and fixes

---
 src/wp_aes_aead.c  |  2 +-
 src/wp_aes_wrap.c  |  1 +
 src/wp_dh_kmgmt.c  |  4 ++--
 src/wp_ecc_kmgmt.c |  2 +-
 src/wp_kdf_exch.c  | 10 ++++++----
 src/wp_logging.c   |  2 +-
 src/wp_mac_sig.c   |  2 +-
 7 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/src/wp_aes_aead.c b/src/wp_aes_aead.c
index 4d921c91..71ae36b7 100644
--- a/src/wp_aes_aead.c
+++ b/src/wp_aes_aead.c
@@ -514,7 +514,7 @@ static int wp_aead_set_param_iv_len(wp_AeadCtx* ctx,
     if (!OSSL_PARAM_get_size_t(p, &sz)) {
         ok = 0;
     }
-    if (ok & ((sz == 0) || (sz > sizeof(ctx->aes.reg)))) {
+    if (ok && ((sz == 0) || (sz > sizeof(ctx->aes.reg)))) {
         ok = 0;
     }
     if (ok) {
diff --git a/src/wp_aes_wrap.c b/src/wp_aes_wrap.c
index 8d43ee18..6dc36129 100644
--- a/src/wp_aes_wrap.c
+++ b/src/wp_aes_wrap.c
@@ -396,6 +396,7 @@ static int wp_aes_wrap_update(wp_AesWrapCtx *ctx, unsigned char *out,
                 WOLFPROV_MSG_DEBUG_RETCODE(WP_LOG_LEVEL_DEBUG, "wc_AesKeyUnWrap", rc);
                 ok = 0;
             }
+        }
     #endif
 
         if (ok) {
diff --git a/src/wp_dh_kmgmt.c b/src/wp_dh_kmgmt.c
index 16173f3e..e5a21cbc 100644
--- a/src/wp_dh_kmgmt.c
+++ b/src/wp_dh_kmgmt.c
@@ -336,7 +336,7 @@ int wp_dh_get_priv(wp_Dh* dh, unsigned char** priv, word32* privSz)
 
     WOLFPROV_ENTER(WP_LOG_COMP_DH, "wp_dh_get_priv");
 
-    if (privSz == 0) {
+    if (dh == NULL || priv == NULL || privSz == NULL) {
         ok = 0;
     }
     else {
@@ -366,7 +366,7 @@ int wp_dh_get_pub(wp_Dh* dh, unsigned char** pub, word32* pubSz)
 
     WOLFPROV_ENTER(WP_LOG_COMP_DH, "wp_dh_get_pub");
 
-    if (pubSz == 0) {
+    if (dh == NULL || pub == NULL || pubSz == NULL) {
         ok = 0;
     }
     else {
diff --git a/src/wp_ecc_kmgmt.c b/src/wp_ecc_kmgmt.c
index b29d1867..c3caf6d2 100644
--- a/src/wp_ecc_kmgmt.c
+++ b/src/wp_ecc_kmgmt.c
@@ -1238,7 +1238,7 @@ static int wp_ecc_import(wp_Ecc* ecc, int selection, const OSSL_PARAM params[])
     if (ok && ((selection & WP_ECC_POSSIBLE_SELECTIONS) == 0)) {
         ok = 0;
     }
-    if (ok & ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) == 0)) {
+    if (ok && ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) == 0)) {
         ok = 0;
     }
     if (ok && (!wp_ecc_import_group(ecc, params))) {
diff --git a/src/wp_kdf_exch.c b/src/wp_kdf_exch.c
index 2ac6dd38..6e4c330c 100644
--- a/src/wp_kdf_exch.c
+++ b/src/wp_kdf_exch.c
@@ -103,9 +103,11 @@ static wp_KdfCtx* wp_kdf_ctx_new(WOLFPROV_CTX* provCtx, const char* name)
  */
 static void wp_kdf_ctx_free(wp_KdfCtx* ctx)
 {
-    wp_kdf_free(ctx->key);
-    EVP_KDF_CTX_free(ctx->kdfCtx);
-    OPENSSL_free(ctx);
+    if (ctx != NULL) {
+        wp_kdf_free(ctx->key);
+        EVP_KDF_CTX_free(ctx->kdfCtx);
+        OPENSSL_free(ctx);
+    }
 }
 
 /**
@@ -133,7 +135,7 @@ static wp_KdfCtx* wp_kdf_ctx_dup(wp_KdfCtx* src)
         }
 
         if (!ok) {
-            OPENSSL_free(dst);
+            wp_kdf_ctx_free(dst);
             dst = NULL;
         }
     }
diff --git a/src/wp_logging.c b/src/wp_logging.c
index c7e69de6..44e1cce5 100644
--- a/src/wp_logging.c
+++ b/src/wp_logging.c
@@ -454,7 +454,7 @@ void WOLFPROV_BUFFER(int component, const unsigned char* buffer,
             }
         }
 
-        wolfprovider_msg(WP_LOG_LEVEL_VERBOSE, component, line);
+        wolfprovider_msg(component, WP_LOG_LEVEL_VERBOSE, line);
         buffer += WOLFPROV_LINE_LEN;
         buflen -= WOLFPROV_LINE_LEN;
     }
diff --git a/src/wp_mac_sig.c b/src/wp_mac_sig.c
index c1ef17d9..e370e08d 100644
--- a/src/wp_mac_sig.c
+++ b/src/wp_mac_sig.c
@@ -299,7 +299,7 @@ static int wp_mac_digest_sign_final(wp_MacSigCtx *ctx, unsigned char *sig,
     if (!wolfssl_prov_is_running()) {
         ok = 0;
     }
-    if (ok & (sigSize == MAX_SIZE_T) && (ctx->type == WP_MAC_TYPE_CMAC)) {
+    if (ok && (sigSize == MAX_SIZE_T) && (ctx->type == WP_MAC_TYPE_CMAC)) {
         sigSize = AES_BLOCK_SIZE;
     }
     if (ok && (!EVP_MAC_final(ctx->macCtx, sig, sigLen, sigSize))) {