Fixes: Fenrir #12347 and #12348:

[aidankeefe2022]

quickassist_sync.c (#12347):

• IntelQaSymAesCbcEncrypt/Decrypt overwrote the caller's IV even when IntelQaSymCipher failed, which corrupted the chaining state for a retry. The IV is now only advanced when ret == 0.
• IntelQaSymDes3CbcEncrypt/Decrypt never advanced the IV, so 3DES-CBC split across several calls on one context did not match a single combined operation. They now chain the IV the same way AES does. On decrypt, the last ciphertext block is saved before the operation so in-place processing still works.
• All four wrappers now check for a full block IV and a non-zero, block-aligned size before working out the last block, so out-of-range last-block arithmetic is no longer possible.
• The wrapper IV parameters are now non-const (byte*), since the wrappers write to them.

quickassist.c (#12348):

• IntelQaSymCipherFree cleared the auth tag fields but left op.cipher.iv/ivSz set. A later decrypt or AES-GCM completion on the same device could then have the callback write the last output block into a stale encrypt IV pointer. Cleanup now clears iv/ivSz and wipes the staged IV. IntelQaSymCipher also resets these fields on every submit, because the op union is shared with other algorithms.
• Async decrypt used to copy the next IV into the caller's buffer at submit time, so a failed operation still advanced the chaining state. The last input block is now staged in a new op.cipher.ivTmp buffer (size QAT_CIPHER_MAX_IV_SZ) and IntelQaSymCipherCallback copies it to the caller's IV only when the operation succeeds.

test.c:

• Add des3_cbc_split_test and aes_cbc_split_test. They check that two-call encrypt, two-call decrypt and two-call in-place decrypt give the same result as a single call. Under async builds each piece is sized to reach WC_ASYNC_THRESH_* so the split calls go through the hardware path.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

stm32-sim-stm32h753

• FLASH: .text +544 B (+0.3%, 195,380 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11694

Scan targets checked: wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs
Coverage: 4 of 4 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11694

Scan targets checked: none
Unchanged since last review (not re-run): wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

The tests defeat WOLFSSL_SMALL_STACK for non-QAT async builds and may exhaust constrained stacks.

1 open finding

• Avoid forcing non-QAT async buffers onto the stack · New

🧠 Review effort: Balanced

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11694

Scan targets checked: wolfcrypt-port-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

fixed