unwrap bounds, CBIO error returns, key zeroization

[JeremiahM37]

Fixes F-3701, F-3702, F-3703, F-3704, F-3705, F-3706, F-3707

• Unwrap copy-loop bounds: fix idx + ofst >= length → idx >= length; report bytes actually copied, not stash size.
• CBIO callbacks: return WOLFSSL_CBIO_ERR_GENERAL on missing cached jobject instead of 0 (graceful-close/zero-write).
• Zero private key bytes: wc_ForceZero on release in X509_sign / X509_REQ_sign / X509_CRL_sign when isCopy.
• Regression tests: two JUnit tests covering unwrap with ofst > 0.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #365

Scan targets checked: wolfssljni-bugs, wolfssljni-src

No new issues found in the changed files. ✅

[Copilot]

Pull request overview

This PR targets JSSE unwrap correctness and native callback/key-handling hardening in wolfssljni. It updates SSLEngine offset handling, adjusts native CBIO error returns, and adds private-key buffer zeroization plus unwrap regression tests.

Changes:

• Fixes WolfSSLEngine.unwrap() offset-based copy bounds and produced-byte accounting, including pending app-data replay.
• Changes context-level native CBIO recv/send missing-object returns from 0 to WOLFSSL_CBIO_ERR_GENERAL.
• Adds private-key buffer wiping in X509/CSR/CRL native sign paths and new JUnit regressions for unwrap with ofst > 0.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/test/com/wolfssl/provider/jsse/test/WolfSSLEngineTest.java	Adds unwrap offset and pending-app-data regression tests.
src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java	Fixes unwrap buffer-index bounds and bytes-produced accounting.
native/com_wolfssl_WolfSSLCRL.c	Adds JNI-copy zeroization in CRL signing cleanup.
native/com_wolfssl_WolfSSLContext.c	Changes context-level CBIO missing-object returns to hard errors.
native/com_wolfssl_WolfSSLCertRequest.c	Adds JNI-copy zeroization in CSR signing cleanup.
native/com_wolfssl_WolfSSLCertificate.c	Adds JNI-copy zeroization in certificate signing cleanup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.