From b00943ce76aa11b4cf6b2b6a94997e56a467b73b Mon Sep 17 00:00:00 2001
From: jordan <jordan@wolfssl.com>
Date: Wed, 22 Jul 2026 12:22:21 -0500
Subject: [PATCH 1/2] ssl: fix miscellaneous issues found in review.

---
 src/ssl_api_cert.c | 5 +++++
 src/ssl_api_pk.c   | 2 +-
 src/ssl_api_rw.c   | 2 +-
 src/ssl_asn1.c     | 5 +++--
 src/ssl_crypto.c   | 4 ++++
 5 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/ssl_api_cert.c b/src/ssl_api_cert.c
index 5809d3faa2..86103aa00c 100644
--- a/src/ssl_api_cert.c
+++ b/src/ssl_api_cert.c
@@ -2836,6 +2836,11 @@ static WOLF_STACK_OF(WOLFSSL_X509)* CreatePeerCertChain(const WOLFSSL* ssl,
         return NULL;
 
     sk = wolfSSL_sk_X509_new_null();
+    if (sk == NULL) {
+        WOLFSSL_MSG("Error Creating sk");
+        return NULL;
+    }
+
     for (i = 0; i < ssl->session->chain.count; i++) {
         x509 = wolfSSL_X509_new_ex(ssl->heap);
         if (x509 == NULL) {
diff --git a/src/ssl_api_pk.c b/src/ssl_api_pk.c
index 238345daca..4223e4921b 100644
--- a/src/ssl_api_pk.c
+++ b/src/ssl_api_pk.c
@@ -2858,7 +2858,7 @@ int wolfSSL_CTX_set_dh_auto(WOLFSSL_CTX* ctx, int onoff)
                 WOLFSSL_MSG("wc_SrpSetPassword failed.");
                 return WOLFSSL_FAILURE;
             }
-            XFREE(ctx->srp_password, NULL, DYNAMIC_TYPE_SRP);
+            XFREE(ctx->srp_password, ctx->heap, DYNAMIC_TYPE_SRP);
             ctx->srp_password = NULL;
         } else {
             /* save password for wolfSSL_set_srp_username */
diff --git a/src/ssl_api_rw.c b/src/ssl_api_rw.c
index c9d1ef6249..b9d897aa49 100644
--- a/src/ssl_api_rw.c
+++ b/src/ssl_api_rw.c
@@ -583,7 +583,7 @@ int wolfSSL_recv(WOLFSSL* ssl, void* data, int sz, int flags)
 int wolfSSL_SendUserCanceled(WOLFSSL* ssl)
 {
     int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
-    WOLFSSL_ENTER("wolfSSL_recv");
+    WOLFSSL_ENTER("wolfSSL_SendUserCanceled");
 
     if (ssl != NULL) {
         ssl->error = SendAlert(ssl, alert_warning, user_canceled);
diff --git a/src/ssl_asn1.c b/src/ssl_asn1.c
index 9768eb4e0d..75cce1edc6 100644
--- a/src/ssl_asn1.c
+++ b/src/ssl_asn1.c
@@ -5855,7 +5855,7 @@ int wc_OBJ_sn2nid(const char *sn)
     static int wolfssl_obj2txt_numeric(char *buf, int bufLen,
                                        const WOLFSSL_ASN1_OBJECT *a)
     {
-        int bufSz;
+        int    bufSz;
         int    length;
         word32 idx = 0;
         byte   tag;
@@ -5874,11 +5874,12 @@ int wc_OBJ_sn2nid(const char *sn)
             return ASN_PARSE_E;
         }
 
+        /* save an extra byte for null term. */
         if (bufLen < MAX_OID_STRING_SZ) {
             bufSz = bufLen - 1;
         }
         else {
-            bufSz = MAX_OID_STRING_SZ;
+            bufSz = MAX_OID_STRING_SZ - 1;
         }
 
         if ((bufSz = DecodePolicyOID(buf, (word32)bufSz, a->obj + idx,
diff --git a/src/ssl_crypto.c b/src/ssl_crypto.c
index 723b0351ee..5b6b88be3d 100644
--- a/src/ssl_crypto.c
+++ b/src/ssl_crypto.c
@@ -4015,6 +4015,8 @@ int wolfSSL_RAND_pseudo_bytes(unsigned char* buf, int num)
     hash = WC_SHA;
     #elif !defined(NO_MD5)
     hash = WC_MD5;
+    #else
+    #error "No PRF hash function available"
     #endif
 
     /* get secret value from source of entropy */
@@ -4029,6 +4031,7 @@ int wolfSSL_RAND_pseudo_bytes(unsigned char* buf, int num)
         PRIVATE_KEY_LOCK();
         ret = (ret == 0) ? WOLFSSL_SUCCESS: WOLFSSL_FAILURE;
     }
+    ForceZero(secret, sizeof(secret));
 #else
     /* fall back to just doing wolfSSL_RAND_bytes if PRF not avialbale */
     ret = wolfSSL_RAND_bytes(buf, num);
@@ -4202,6 +4205,7 @@ int wolfSSL_RAND_poll(void)
     }
 
     wc_UnLockMutex(&globalRNGMutex);
+    ForceZero(entropy, sizeof(entropy));
 
     return ret;
 }

From df73fa1b60a5ec1d4078f4d808ecf20defdd6184 Mon Sep 17 00:00:00 2001
From: jordan <jordan@wolfssl.com>
Date: Thu, 23 Jul 2026 21:50:13 -0500
Subject: [PATCH 2/2] ssl_api_cert: remove dead sk null check.

---
 src/ssl_api_cert.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/ssl_api_cert.c b/src/ssl_api_cert.c
index 86103aa00c..8bc0f2dfaa 100644
--- a/src/ssl_api_cert.c
+++ b/src/ssl_api_cert.c
@@ -2867,9 +2867,6 @@ static WOLF_STACK_OF(WOLFSSL_X509)* CreatePeerCertChain(const WOLFSSL* ssl,
         }
     }
 
-    if (sk == NULL) {
-        WOLFSSL_MSG("Null session chain");
-    }
     return sk;
 }