Fix decrypt-context leak on abandoned streaming EnvelopedData decode

wc_PKCS7_Free() released cachedEncryptedContent but never released
pkcs7->decryptKey, the content-cipher context (Aes/Des/Des3) allocated
by wc_PKCS7_DecryptContentInit() on the streaming EnvelopedData decode
path. On WC_PKCS7_WANT_READ_E the decode deliberately keeps that context
to resume on the next input chunk, so a decode abandoned mid-message
(e.g. a truncated or malformed streaming message the caller gives up on)
and then freed leaked the cipher context.

wc_PKCS7_DecodeEnvelopedData()'s own error cleanup only runs for hard
errors (ret < 0 && ret != WC_PKCS7_WANT_READ_E), so it does not cover
the abandoned-WANT_READ case; the release has to happen in
wc_PKCS7_Free(). Before tearing down the stream, and only when a decrypt
context is still pending (decryptKey non-NULL), retrieve the content
cipher OID from the stream's saved var and call
wc_PKCS7_DecryptContentFree(). decryptKey is only ever left allocated by
this flow, where that saved var holds the content cipher OID; gating on
it leaves completed decodes and other streaming flows (whose saved var
is unrelated to any cipher) untouched, and avoids a spurious
"Unsupported content cipher type" debug message on their teardown.

Exposed by the new constructed-definite [0] negative tests, which decode
a malformed message (returning WC_PKCS7_WANT_READ_E) and then free the
wc_PKCS7 -- flagged by LeakSanitizer in CI.

Author: Frauschi

wolfcrypt/src/pkcs7.c

@@ -1494,13 +1494,42 @@ static int wc_PKCS7_SignerInfoSetSID(wc_PKCS7* pkcs7, byte* in, int inSz)
 }
 
 
+#if !defined(NO_PKCS7_STREAM) && (!defined(NO_DES3) || !defined(NO_AES))
+/* defined later in this file; needed here to release a decrypt context left
+ * initialized by an abandoned streaming decode */
+static void wc_PKCS7_DecryptContentFree(wc_PKCS7* pkcs7, word32 encryptOID,
+    void* heap);
+#endif
+
 /* releases any memory allocated by a PKCS7 initializer */
 void wc_PKCS7_Free(wc_PKCS7* pkcs7)
 {
     if (pkcs7 == NULL)
         return;
 
 #ifndef NO_PKCS7_STREAM
+    /* A streaming EnvelopedData decode that was abandoned mid-message (e.g. it
+     * returned WC_PKCS7_WANT_READ_E and was never resumed) leaves the
+     * content-decryption context allocated by wc_PKCS7_DecryptContentInit().
+     * Release it before tearing down the stream so it is not leaked. Only the
+     * EnvelopedData decode path allocates decryptKey, and only there does the
+     * stream's first saved var hold the content cipher OID, so gate on a
+     * pending context: when decryptKey is NULL there is nothing to free and
+     * the (unrelated) saved var of another streaming decode must not be
+     * interpreted as a cipher OID. */
+#if !defined(NO_DES3) || !defined(NO_AES)
+    if (pkcs7->stream != NULL &&
+    #ifndef NO_AES
+            pkcs7->decryptKey.aes != NULL
+    #else
+            pkcs7->decryptKey.des3 != NULL
+    #endif
+       ) {
+        word32 encOID = 0;
+        wc_PKCS7_StreamGetVar(pkcs7, &encOID, NULL, NULL);
+        wc_PKCS7_DecryptContentFree(pkcs7, encOID, pkcs7->heap);
+    }
+#endif
     wc_PKCS7_FreeStream(pkcs7);
 #endif