ssl: fix miscellaneous issues found in review.

[philljj]

Description

Fixes some pre-existing issues found by copilot while reviewing another PR (#10926).

• src/ssl_api_cert.c: add missing NULL check.
• src/ssl_api_pk.c: add missing heap hint pointer.
• src/ssl_api_rw.c: correct WOLFSSL_ENTER message.
• src/ssl_asn1.c: save byte for nul term (relevant when bufLen == MAX_OID_STRING_SZ).
• src/ssl_crypto.c:
  • add #else #error clause if no hash function available.
  • add missing ForceZero for secret and entropy.

Testing

multi-test:

• all-c89-clang-tidy
• linuxkm-fips-*-intelasm-LKCAPI-insmod

[Copilot]

Pull request overview

This PR addresses several small correctness and hardening issues in the wolfSSL OpenSSL-compat/API surface, including safer handling of sensitive buffers, a string-termination fix, and a few API correctness fixes.

Changes:

• Harden RNG-related code paths by wiping sensitive temporary buffers and tightening PRF hash selection.
• Fix OID numeric string conversion to reliably reserve space for NUL termination.
• Correct API tracing/logging and memory free behavior, and add a missing allocation failure check.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/ssl_crypto.c	Adds entropy/secret buffer zeroization and adjusts PRF hash selection logic for wolfSSL_RAND_pseudo_bytes/wolfSSL_RAND_poll.
src/ssl_asn1.c	Fixes an off-by-one risk by reserving space for NUL termination when decoding OIDs into strings.
src/ssl_api_rw.c	Fixes an incorrect WOLFSSL_ENTER() trace string in wolfSSL_SendUserCanceled.
src/ssl_api_pk.c	Frees ctx->srp_password using the correct heap (ctx->heap).
src/ssl_api_cert.c	Adds a NULL check for wolfSSL_sk_X509_new_null() allocation failure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +64 B (+0.1%, 122,603 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 200,853 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +512 B (+0.1%, 769,724 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +256 B (+0.1%, 326,168 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 123,355 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 200,853 B / 262,144 B, total: 77% used)

linuxkm-standard

• Data: __patchable_function_entries +40 B (+0.1%, 48,656 B)

stm32-sim-stm32h753

• FLASH: .text +64 B (+0.0%, 183,892 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie

[philljj]

Retest this please.

(passed then aborted, no logs).

[Frauschi]

LGTM

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10972

Scan targets checked: wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

🔵 [Low] Dead sk == NULL check after new early-return guard · Dead error handling

The PR adds an early return NULL when wolfSSL_sk_X509_new_null() returns NULL (line 2839), making the pre-existing if (sk == NULL) check at line 2870 unreachable — sk is never reassigned after line 2838.

Fix: Remove the dead if (sk == NULL) block at line 2870, or replace it with a WOLFSSL_ASSERT if the invariant is worth documenting.

[philljj]

silly oversight on my part, fixed.