Fix various issues

[kareem-wolfssl]

Description

Fixes zd#22229

Testing

Built in tests, provided reproducers

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text -4 B (-0.0%, 122,607 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 771,476 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 213,972 B / 262,144 B, total: 82% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 326,168 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 236,679 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 280,576 B / 1,048,576 B, total: 27% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Copilot]

🟡 Not ready to approve

It includes an accidentally committed .rej artifact and CMake still needs to export/check HAVE_SYS_UN_H to avoid public ABI/layout mismatches for consumers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR addresses multiple correctness and robustness issues across certificate name/IP checking, PKCS#7 SignedData streaming verification, and big-integer cleanup paths, with accompanying API tests and build-system adjustments to keep public header feature macros consistent between library and consumers.

Changes:

• Hardened PKCS#7 SignedData streaming parsing to avoid accepting truncated footers and to correctly error when required signerInfos is missing; added tests to cover the cases.
• Updated IP alt-name checking to respect the caller-provided length (avoid reliance on NUL termination) and added an OpenSSL-compat test for bounded inputs.
• Made several bigint cleanup paths safer by zero-initializing heap-allocated mp_int structs when initialization may be skipped; updated build configuration to export HAVE_SYS_TIME_H.

File summaries

File	Description
wolfssl/internal.h	Extends internal CheckIPAddr prototype to accept an explicit input length.
src/internal.c	Updates CheckIPAddr implementation and internal call sites to pass explicit lengths.
src/x509.c	Updates X509 host/IP checking to pass bounded lengths into IP-alt-name checks.
tests/api/test_ossl_x509.c	Adds a bounded (non-NUL-terminated) host-name test to verify length-respecting behavior.
wolfcrypt/src/pkcs7.c	Adjusts streaming stage windowing/capping to avoid stalling and to reject missing signerInfos.
tests/api/test_pkcs7.c	Removes NO_PKCS7_STREAM gating for a truncation test; adds a new “no signerInfos” regression test.
tests/api/test_pkcs7.h	Declares/registers the new PKCS#7 regression test.
wolfcrypt/src/srp.c	Zero-initializes heap-allocated mp_int temporaries so cleanup is safe when init is skipped.
wolfcrypt/src/ecc.c	Zero-initializes mp_int temporaries in a verification-faults path so cleanup is safe on early error.
wolfcrypt/src/rsa.c	Zero-initializes heap-allocated mp_int temporaries so cleanup is safe when init is skipped.
wolfcrypt/src/rsa.c.rej	Adds a patch reject artifact file in-tree (should not be committed).
configure.ac	Adjusts header checks and exports HAVE_SYS_UN_H/HAVE_SYS_TIME_H via CPP flags for public header layout consistency.
CMakeLists.txt	Ensures in-tree CMake builds propagate HAVE_SYS_TIME_H to match installed headers.
cmake/options.h.in	Exports HAVE_SYS_TIME_H via generated options header for consumers.
cmake/config.in	Removes HAVE_SYS_TIME_H from CMake-generated config header (now exported via options header).

Review details

• Files reviewed: 15/15 changed files
• Comments generated: 3
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.