Force-zero wc_AesSivDecrypt*() output buffer on authentication failure

Author: holtrop-wolfssl

wolfcrypt/src/aes.c

@@ -17094,10 +17094,14 @@ static WARN_UNUSED_RESULT int AesSivCipher(
                 WOLFSSL_MSG("S2V failed.");
             }
 
-            if (ConstantCompare(siv, sivTmp, WC_AES_BLOCK_SIZE) != 0) {
+            if (ret == 0 && ConstantCompare(siv, sivTmp, WC_AES_BLOCK_SIZE) != 0) {
                 WOLFSSL_MSG("Computed SIV doesn't match received SIV.");
                 ret = AES_SIV_AUTH_E;
             }
+
+            if (ret != 0) {
+                ForceZero(out, dataSz);
+            }
         }
 
     #ifdef WOLFSSL_SMALL_STACK

wolfcrypt/test/test.c

@@ -74789,6 +74789,7 @@ static wc_test_ret_t aes_siv_negative_test(const AesSivTestVector* testVectors)
     byte computedCiphertext[82];
     byte computedPlaintext[82];
     byte siv[WC_AES_BLOCK_SIZE];
+    word32 j;
     wc_test_ret_t ret;
 
     /* Negative test: corrupted SIV must be rejected with AES_SIV_AUTH_E. */
@@ -74801,6 +74802,7 @@ static wc_test_ret_t aes_siv_negative_test(const AesSivTestVector* testVectors)
     if (ret != 0) {
         return WC_TEST_RET_ENC_EC(ret);
     }
+    XMEMSET(computedPlaintext, 0xFF, sizeof(computedPlaintext));
     /* Corrupt one byte of the SIV tag. */
     siv[0] ^= 0x01;
     ret = wc_AesSivDecrypt(testVectors[0].key, testVectors[0].keySz,
@@ -74811,6 +74813,11 @@ static wc_test_ret_t aes_siv_negative_test(const AesSivTestVector* testVectors)
     if (ret != WC_NO_ERR_TRACE(AES_SIV_AUTH_E)) {
         return WC_TEST_RET_ENC_EC(ret);
     }
+    for (j = 0; j < testVectors[0].plaintextSz; ++j) {
+        if (computedPlaintext[j] != 0) {
+            return WC_TEST_RET_ENC_NC;
+        }
+    }
     return 0;
 }