From ef77203732e8b07429641060ef541b59651a48d2 Mon Sep 17 00:00:00 2001
From: Arpan Sharma <arpans0995@gmail.com>
Date: Sat, 3 Oct 2026 09:18:54 -0500
Subject: [PATCH] ML-DSA: check len for NULL in the key length getters

wc_MlDsaKey_GetPrivLen(), wc_MlDsaKey_GetPubLen() and
wc_MlDsaKey_GetSigLen() wrote through len without checking it. Return
BAD_FUNC_ARG for a NULL len, as documented and as the LMS and XMSS
getters do, and add NULL len cases to test_wc_MldsaDecisionCoverage().
---
 tests/api/test_mldsa.c   |  7 +++++++
 wolfcrypt/src/wc_mldsa.c | 39 +++++++++++++++++++++++++++------------
 2 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/tests/api/test_mldsa.c b/tests/api/test_mldsa.c
index f3749d684b4..ce9a26d43c8 100644
--- a/tests/api/test_mldsa.c
+++ b/tests/api/test_mldsa.c
@@ -30713,6 +30713,9 @@ int test_wc_MldsaDecisionCoverage(void)
     len = 0;
     ExpectIntEQ(wc_MlDsaKey_GetPubLen(NULL, &len),
         WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    /* Valid key with a NULL len -> BAD_FUNC_ARG. */
+    ExpectIntEQ(wc_MlDsaKey_GetPubLen(&key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
     /* Valid key with a level set -> *len >= 0, decision FALSE side, ret 0. */
     len = 0;
     ExpectIntEQ(wc_MlDsaKey_GetPubLen(&key, &len), 0);
@@ -30722,6 +30725,8 @@ int test_wc_MldsaDecisionCoverage(void)
     len = 0;
     ExpectIntEQ(wc_MlDsaKey_GetPrivLen(NULL, &len),
         WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_MlDsaKey_GetPrivLen(&key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
     len = 0;
     ExpectIntEQ(wc_MlDsaKey_GetPrivLen(&key, &len), 0);
     ExpectIntGT(len, 0);
@@ -30730,6 +30735,8 @@ int test_wc_MldsaDecisionCoverage(void)
     len = 0;
     ExpectIntEQ(wc_MlDsaKey_GetSigLen(NULL, &len),
         WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_MlDsaKey_GetSigLen(&key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
     len = 0;
     ExpectIntEQ(wc_MlDsaKey_GetSigLen(&key, &len), 0);
     ExpectIntGT(len, 0);
diff --git a/wolfcrypt/src/wc_mldsa.c b/wolfcrypt/src/wc_mldsa.c
index 8fade7cfb5f..e624e298d4b 100644
--- a/wolfcrypt/src/wc_mldsa.c
+++ b/wolfcrypt/src/wc_mldsa.c
@@ -12532,15 +12532,20 @@ int wc_MlDsaKey_PrivSize(wc_MlDsaKey* key)
  * @param [in]  key  ML-DSA private/public key.
  * @param [out] len  Private key size for set level.
  * @return  0 on success.
- * @return  BAD_FUNC_ARG when key is NULL or level not set,
+ * @return  BAD_FUNC_ARG when key or len is NULL or level not set,
  */
 int wc_MlDsaKey_GetPrivLen(wc_MlDsaKey* key, int* len)
 {
     int ret = 0;
 
-    *len = wc_MlDsaKey_PrivSize(key);
-    if (*len < 0) {
-        ret = *len;
+    if (len == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        *len = wc_MlDsaKey_PrivSize(key);
+        if (*len < 0) {
+            ret = *len;
+        }
     }
 
     return ret;
@@ -12594,15 +12599,20 @@ int wc_MlDsaKey_PubSize(wc_MlDsaKey* key)
  * @param [in]  key  ML-DSA private/public key.
  * @param [out] len  Public key size for set level.
  * @return  0 on success.
- * @return  BAD_FUNC_ARG when key is NULL or level not set,
+ * @return  BAD_FUNC_ARG when key or len is NULL or level not set,
  */
 int wc_MlDsaKey_GetPubLen(wc_MlDsaKey* key, int* len)
 {
     int ret = 0;
 
-    *len = wc_MlDsaKey_PubSize(key);
-    if (*len < 0) {
-        ret = *len;
+    if (len == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        *len = wc_MlDsaKey_PubSize(key);
+        if (*len < 0) {
+            ret = *len;
+        }
     }
 
     return ret;
@@ -12655,15 +12665,20 @@ int wc_MlDsaKey_SigSize(wc_MlDsaKey* key)
  * @param [in]  key  ML-DSA private/public key.
  * @param [out] len  Signature size for set level.
  * @return  0 on success.
- * @return  BAD_FUNC_ARG when key is NULL or level not set,
+ * @return  BAD_FUNC_ARG when key or len is NULL or level not set,
  */
 int wc_MlDsaKey_GetSigLen(wc_MlDsaKey* key, int* len)
 {
     int ret = 0;
 
-    *len = wc_MlDsaKey_SigSize(key);
-    if (*len < 0) {
-        ret = *len;
+    if (len == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        *len = wc_MlDsaKey_SigSize(key);
+        if (*len < 0) {
+            ret = *len;
+        }
     }
 
     return ret;