Skip to content

Deregister native FIPS error callback on library cleanup or reset#337

Open
cconlon wants to merge 1 commit intowolfSSL:masterfrom
cconlon:fipsCallbackGC
Open

Deregister native FIPS error callback on library cleanup or reset#337
cconlon wants to merge 1 commit intowolfSSL:masterfrom
cconlon:fipsCallbackGC

Conversation

@cconlon
Copy link
Member

@cconlon cconlon commented Feb 24, 2026

This PR cleans up use of the native wolfSSL FIPS callback, resetting it back to null to prevent possible issues where it could be called from native wolfSSL after the Java provider has been garbage collected.

  • Call wolfCrypt_SetCb_fips(NULL) before deleting the Java global ref to fully deregister the native callback
  • When called with a NULL callback, now properly calls wolfCrypt_SetCb_fips(NULL) instead of only deleting the Java global ref
  • Add NULL guard for g_fipsCbIfaceObj in NativeFIPSErrorCallback() before calling GetObjectRefType (undefined behavior on NULL), and return silently on invalid references instead of throwing exceptions from the C callback

@cconlon cconlon self-assigned this Feb 24, 2026
Copilot AI review requested due to automatic review settings February 24, 2026 00:45
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR improves lifecycle management for the wolfCrypt FIPS error callback by explicitly deregistering the native callback and hardening the native-to-Java callback path against invalid/cleared references during cleanup/reset.

Changes:

  • Deregister the native wolfCrypt FIPS callback during WolfSSL.cleanup().
  • Ensure setFIPSCb(NULL) deregisters the native callback (not just the Java global ref).
  • Add guards in NativeFIPSErrorCallback() to avoid JNI UB on NULL/invalid callback references and avoid throwing from within the C callback.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…NULL), guard NativeFIPSErrorCallback against invalid object refs
@cconlon cconlon assigned rlm2002 and unassigned cconlon Feb 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants