From db1fb36613d0c585aed8280bb4b988557cb84bbf Mon Sep 17 00:00:00 2001
From: night1rider <backman23@live.com>
Date: Tue, 25 Aug 2026 00:33:31 -0600
Subject: [PATCH] nxp hashcrypt: validate AES ECB/CBC args and zero-length
 Reject NULL aes/in/out with BAD_FUNC_ARG and return early on zero length
 before key setup and the sz-16 IV copy, matching wc_AesCtrEncrypt.

---
 wolfcrypt/src/port/nxp/hashcrypt_port.c | 33 ++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/wolfcrypt/src/port/nxp/hashcrypt_port.c b/wolfcrypt/src/port/nxp/hashcrypt_port.c
index 5f4d43c5786..dc568d2e192 100644
--- a/wolfcrypt/src/port/nxp/hashcrypt_port.c
+++ b/wolfcrypt/src/port/nxp/hashcrypt_port.c
@@ -211,8 +211,15 @@ static int _hashcrypt_set_key(Aes* aes)
 #ifdef HAVE_AES_ECB
 int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 {
-    int ret = _hashcrypt_set_key(aes);
+    int ret;
+
+    if (aes == NULL || out == NULL || in == NULL)
+        return BAD_FUNC_ARG;
 
+    if (sz == 0)
+        return 0;
+
+    ret = _hashcrypt_set_key(aes);
     if (ret)
         return ret;
 
@@ -226,8 +233,15 @@ int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 #ifdef HAVE_AES_DECRYPT
 int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 {
-    int ret = _hashcrypt_set_key(aes);
+    int ret;
+
+    if (aes == NULL || out == NULL || in == NULL)
+        return BAD_FUNC_ARG;
+
+    if (sz == 0)
+        return 0;
 
+    ret = _hashcrypt_set_key(aes);
     if (ret)
         return ret;
 
@@ -243,8 +257,15 @@ int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 #ifdef HAVE_AES_CBC
 int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 {
-    int ret = _hashcrypt_set_key(aes);
+    int ret;
+
+    if (aes == NULL || out == NULL || in == NULL)
+        return BAD_FUNC_ARG;
+
+    if (sz == 0)
+        return 0;
 
+    ret = _hashcrypt_set_key(aes);
     if (ret)
         return ret;
 
@@ -264,6 +285,12 @@ int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     int ret;
     byte tmp_iv[16];
 
+    if (aes == NULL || out == NULL || in == NULL)
+        return BAD_FUNC_ARG;
+
+    if (sz == 0)
+        return 0;
+
     ret = _hashcrypt_set_key(aes);
     if (ret)
         return ret;