Regenerate SP sources: clamp from_mp read index (review fix)

Regenerated with the updated generator so sp_<N>_from_mp() clamps the read
index to a valid digit (0 when a->used == 0), avoiding an out-of-bounds or
NULL digit read in the fixed-count constant-time loop while keeping the
conversion constant time.

Addresses the Copilot review comments on this PR (wolfSSL#10898) and
on wolfSSL/scripts#626. Verified (--enable-sp, gcc 15.2): ec_p521_kex diff 0,
ec_p521_sign diff 55; make check passes.

Generated by wolfSSL/scripts#626

Author: danielinux

wolfcrypt/src/sp_arm32.c

@@ -206,19 +206,27 @@ static void sp_2048_from_mp(sp_digit* r, int size, const mp_int* a)
 #elif DIGIT_BIT > 32
     unsigned int i;
     int j = 0;
+    int o;
+    int last = (int)a->used - 1;
     word32 s = 0;
     sp_uint32 d;
     sp_uint32 mask;
 
+    /* Last valid digit index; 0 when a->used == 0 (as in the == branch). */
+    last &= 0 - (a->used > 0);
     r[0] = 0;
     /* Loop a fixed number of times (bounded by the output size, not by
-     * a->used) and mask input digits at or after a->used to zero, so
-     * converting a secret value runs in constant time. */
+     * a->used). Clamp the read index to a valid digit and mask digits at or
+     * after a->used to zero, so a secret value is converted in constant time
+     * without reading past the mp_int digit array. */
     for (i = 0; j < size; i++) {
         /* mask = all ones while i < a->used, else zero (branchless). */
         mask = (sp_uint32)0 - (((sp_uint32)i - (sp_uint32)(unsigned int)a->used) >>
             (sizeof(sp_uint32) * 8 - 1));
-        d = (sp_uint32)a->dp[i] & mask;
+        /* o = i while i < a->used, else the last valid index (in bounds). */
+        o = (int)(((unsigned int)i & (unsigned int)mask) |
+            ((unsigned int)last & ~(unsigned int)mask));
+        d = (sp_uint32)a->dp[o] & mask;
         r[j] |= (d << s);
         r[j] &= 0xffffffff;
         s = 32U - s;
@@ -18974,19 +18982,27 @@ static void sp_3072_from_mp(sp_digit* r, int size, const mp_int* a)
 #elif DIGIT_BIT > 32
     unsigned int i;
     int j = 0;
+    int o;
+    int last = (int)a->used - 1;
     word32 s = 0;
     sp_uint32 d;
     sp_uint32 mask;
 
+    /* Last valid digit index; 0 when a->used == 0 (as in the == branch). */
+    last &= 0 - (a->used > 0);
     r[0] = 0;
     /* Loop a fixed number of times (bounded by the output size, not by
-     * a->used) and mask input digits at or after a->used to zero, so
-     * converting a secret value runs in constant time. */
+     * a->used). Clamp the read index to a valid digit and mask digits at or
+     * after a->used to zero, so a secret value is converted in constant time
+     * without reading past the mp_int digit array. */
     for (i = 0; j < size; i++) {
         /* mask = all ones while i < a->used, else zero (branchless). */
         mask = (sp_uint32)0 - (((sp_uint32)i - (sp_uint32)(unsigned int)a->used) >>
             (sizeof(sp_uint32) * 8 - 1));
-        d = (sp_uint32)a->dp[i] & mask;
+        /* o = i while i < a->used, else the last valid index (in bounds). */
+        o = (int)(((unsigned int)i & (unsigned int)mask) |
+            ((unsigned int)last & ~(unsigned int)mask));
+        d = (sp_uint32)a->dp[o] & mask;
         r[j] |= (d << s);
         r[j] &= 0xffffffff;
         s = 32U - s;
@@ -47009,19 +47025,27 @@ static void sp_4096_from_mp(sp_digit* r, int size, const mp_int* a)
 #elif DIGIT_BIT > 32
     unsigned int i;
     int j = 0;
+    int o;
+    int last = (int)a->used - 1;
     word32 s = 0;
     sp_uint32 d;
     sp_uint32 mask;
 
+    /* Last valid digit index; 0 when a->used == 0 (as in the == branch). */
+    last &= 0 - (a->used > 0);
     r[0] = 0;
     /* Loop a fixed number of times (bounded by the output size, not by
-     * a->used) and mask input digits at or after a->used to zero, so
-     * converting a secret value runs in constant time. */
+     * a->used). Clamp the read index to a valid digit and mask digits at or
+     * after a->used to zero, so a secret value is converted in constant time
+     * without reading past the mp_int digit array. */
     for (i = 0; j < size; i++) {
         /* mask = all ones while i < a->used, else zero (branchless). */
         mask = (sp_uint32)0 - (((sp_uint32)i - (sp_uint32)(unsigned int)a->used) >>
             (sizeof(sp_uint32) * 8 - 1));
-        d = (sp_uint32)a->dp[i] & mask;
+        /* o = i while i < a->used, else the last valid index (in bounds). */
+        o = (int)(((unsigned int)i & (unsigned int)mask) |
+            ((unsigned int)last & ~(unsigned int)mask));
+        d = (sp_uint32)a->dp[o] & mask;
         r[j] |= (d << s);
         r[j] &= 0xffffffff;
         s = 32U - s;
@@ -67773,19 +67797,27 @@ static void sp_256_from_mp(sp_digit* r, int size, const mp_int* a)
 #elif DIGIT_BIT > 32
     unsigned int i;
     int j = 0;
+    int o;
+    int last = (int)a->used - 1;
     word32 s = 0;
     sp_uint32 d;
     sp_uint32 mask;
 
+    /* Last valid digit index; 0 when a->used == 0 (as in the == branch). */
+    last &= 0 - (a->used > 0);
     r[0] = 0;
     /* Loop a fixed number of times (bounded by the output size, not by
-     * a->used) and mask input digits at or after a->used to zero, so
-     * converting a secret value runs in constant time. */
+     * a->used). Clamp the read index to a valid digit and mask digits at or
+     * after a->used to zero, so a secret value is converted in constant time
+     * without reading past the mp_int digit array. */
     for (i = 0; j < size; i++) {
         /* mask = all ones while i < a->used, else zero (branchless). */
         mask = (sp_uint32)0 - (((sp_uint32)i - (sp_uint32)(unsigned int)a->used) >>
             (sizeof(sp_uint32) * 8 - 1));
-        d = (sp_uint32)a->dp[i] & mask;
+        /* o = i while i < a->used, else the last valid index (in bounds). */
+        o = (int)(((unsigned int)i & (unsigned int)mask) |
+            ((unsigned int)last & ~(unsigned int)mask));
+        d = (sp_uint32)a->dp[o] & mask;
         r[j] |= (d << s);
         r[j] &= 0xffffffff;
         s = 32U - s;
@@ -90910,19 +90942,27 @@ static void sp_384_from_mp(sp_digit* r, int size, const mp_int* a)
 #elif DIGIT_BIT > 32
     unsigned int i;
     int j = 0;
+    int o;
+    int last = (int)a->used - 1;
     word32 s = 0;
     sp_uint32 d;
     sp_uint32 mask;
 
+    /* Last valid digit index; 0 when a->used == 0 (as in the == branch). */
+    last &= 0 - (a->used > 0);
     r[0] = 0;
     /* Loop a fixed number of times (bounded by the output size, not by
-     * a->used) and mask input digits at or after a->used to zero, so
-     * converting a secret value runs in constant time. */
+     * a->used). Clamp the read index to a valid digit and mask digits at or
+     * after a->used to zero, so a secret value is converted in constant time
+     * without reading past the mp_int digit array. */
     for (i = 0; j < size; i++) {
         /* mask = all ones while i < a->used, else zero (branchless). */
         mask = (sp_uint32)0 - (((sp_uint32)i - (sp_uint32)(unsigned int)a->used) >>
             (sizeof(sp_uint32) * 8 - 1));
-        d = (sp_uint32)a->dp[i] & mask;
+        /* o = i while i < a->used, else the last valid index (in bounds). */
+        o = (int)(((unsigned int)i & (unsigned int)mask) |
+            ((unsigned int)last & ~(unsigned int)mask));
+        d = (sp_uint32)a->dp[o] & mask;
         r[j] |= (d << s);
         r[j] &= 0xffffffff;
         s = 32U - s;
@@ -117770,19 +117810,27 @@ static void sp_521_from_mp(sp_digit* r, int size, const mp_int* a)
 #elif DIGIT_BIT > 32
     unsigned int i;
     int j = 0;
+    int o;
+    int last = (int)a->used - 1;
     word32 s = 0;
     sp_uint32 d;
     sp_uint32 mask;
 
+    /* Last valid digit index; 0 when a->used == 0 (as in the == branch). */
+    last &= 0 - (a->used > 0);
     r[0] = 0;
     /* Loop a fixed number of times (bounded by the output size, not by
-     * a->used) and mask input digits at or after a->used to zero, so
-     * converting a secret value runs in constant time. */
+     * a->used). Clamp the read index to a valid digit and mask digits at or
+     * after a->used to zero, so a secret value is converted in constant time
+     * without reading past the mp_int digit array. */
     for (i = 0; j < size; i++) {
         /* mask = all ones while i < a->used, else zero (branchless). */
         mask = (sp_uint32)0 - (((sp_uint32)i - (sp_uint32)(unsigned int)a->used) >>
             (sizeof(sp_uint32) * 8 - 1));
-        d = (sp_uint32)a->dp[i] & mask;
+        /* o = i while i < a->used, else the last valid index (in bounds). */
+        o = (int)(((unsigned int)i & (unsigned int)mask) |
+            ((unsigned int)last & ~(unsigned int)mask));
+        d = (sp_uint32)a->dp[o] & mask;
         r[j] |= (d << s);
         r[j] &= 0xffffffff;
         s = 32U - s;
@@ -147580,19 +147628,27 @@ static void sp_1024_from_mp(sp_digit* r, int size, const mp_int* a)
 #elif DIGIT_BIT > 32
     unsigned int i;
     int j = 0;
+    int o;
+    int last = (int)a->used - 1;
     word32 s = 0;
     sp_uint32 d;
     sp_uint32 mask;
 
+    /* Last valid digit index; 0 when a->used == 0 (as in the == branch). */
+    last &= 0 - (a->used > 0);
     r[0] = 0;
     /* Loop a fixed number of times (bounded by the output size, not by
-     * a->used) and mask input digits at or after a->used to zero, so
-     * converting a secret value runs in constant time. */
+     * a->used). Clamp the read index to a valid digit and mask digits at or
+     * after a->used to zero, so a secret value is converted in constant time
+     * without reading past the mp_int digit array. */
     for (i = 0; j < size; i++) {
         /* mask = all ones while i < a->used, else zero (branchless). */
         mask = (sp_uint32)0 - (((sp_uint32)i - (sp_uint32)(unsigned int)a->used) >>
             (sizeof(sp_uint32) * 8 - 1));
-        d = (sp_uint32)a->dp[i] & mask;
+        /* o = i while i < a->used, else the last valid index (in bounds). */
+        o = (int)(((unsigned int)i & (unsigned int)mask) |
+            ((unsigned int)last & ~(unsigned int)mask));
+        d = (sp_uint32)a->dp[o] & mask;
         r[j] |= (d << s);
         r[j] &= 0xffffffff;
         s = 32U - s;