[aidankeefe2022]

Description

F-7325: Write before free
F-16325 NULL dereference
F-16327 Out-of-bounds read
Fixes zd https://wolfssl.zendesk.com/agent/tickets/22767 and https://wolfssl.zendesk.com/agent/tickets/22764

Testing

regression tests.

Checklist

• added tests

[Copilot]

🟢 Approval recommended

No active review issues were identified for the X.509 extension memory-safety changes and accompanying regression coverage.

No open issues 🎉

What changed in this PR

This PR fixes memory-safety issues in wolfSSL’s OpenSSL-compatible X.509 extension handling and adds regression coverage.

Changes:

• Handles empty authority-information-access entries and copies key identifiers from their original encoded data.
• Releases the preallocated string before storing a directory-name subject alternative name.
• Adds regression tests and a certificate fixture with generation and distribution support.

File	Description
tests/​api/​test_ossl_x509_ext.h	Declares and registers the new regression tests.
tests/​api/​test_ossl_x509_ext.c	Tests directory-name SANs, empty AIA stacks, and variable-length key identifiers.
src/​x509.c	Fixes null handling, key-identifier copying, and directory-name memory ownership.
certs/​test/​include.am	Adds the certificate fixture files to source distributions.
certs/​test/​gen-ext-certs.sh	Adds generation of the directory-name SAN certificate.
certs/​test/​cert-ext-dirsan.pem	Provides the certificate fixture used by the SAN regression test.
certs/​test/​cert-ext-dirsan.cfg	Defines the fixture’s DNS and directory-name SAN entries.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +28 B, text +11,728 B (+4.2%, 294,228 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12131

Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): certs/test/cert-ext-dirsan.cfg, certs/test/cert-ext-dirsan.der, certs/test/cert-ext-dirsan.pem, certs/test/gen-ext-certs.sh, certs/test/include.am, tests/api/test_ossl_x509_ext.h
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max