From fb26dcc3f86b4f039f6c2e014a1f287c01601dbf Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Fri, 30 Oct 2026 15:15:53 -0700
Subject: [PATCH 1/2] Fix the cppcheck 2.13 findings

Restructure the two sites that left a redundant check in one build
configuration, and suppress a warning that only appears in a
configuration cppcheck invents.

- wolfsshd.c: set the -h host key file in the else of the cert store
  conflict check instead of retesting ret.
- internal.c CompositeEccSign: run wc_ecc_sig_to_rs from an else shared
  by the small-stack allocation check and the plain stack arrays.
- wolfsftp.c: suppress constStatement on WWRITE; cppcheck's -DWWRITE
  configuration turns the arguments into a comma expression.
---
 apps/wolfsshd/wolfsshd.c |  3 ++-
 src/internal.c           | 27 +++++++++------------------
 src/wolfsftp.c           |  1 +
 3 files changed, 12 insertions(+), 19 deletions(-)

diff --git a/apps/wolfsshd/wolfsshd.c b/apps/wolfsshd/wolfsshd.c
index 58ce36c0d..003851260 100644
--- a/apps/wolfsshd/wolfsshd.c
+++ b/apps/wolfsshd/wolfsshd.c
@@ -4631,8 +4631,9 @@ static int StartSSHD(int argc, char** argv)
                 "wolfSSH_HostKeyStore. Use one or the other.");
             ret = WS_BAD_ARGUMENT;
         }
+        else
     #endif
-        if (ret == WS_SUCCESS) {
+        {
             wolfSSHD_ConfigSetHostKeyFile(conf, hostKeyFile);
         }
     }
diff --git a/src/internal.c b/src/internal.c
index 3b305d0d3..f142c0db9 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -25464,28 +25464,19 @@ static int CompositeEccSign(void* key, WC_RNG* rng, void* heap,
         word32 rSz = MAX_ECC_BYTES + ECC_MAX_PAD_SZ,
                sSz = MAX_ECC_BYTES + ECC_MAX_PAD_SZ;
 #ifdef WOLFSSH_SMALL_STACK
-        byte* rBuf = NULL;
-        byte* sBuf = NULL;
-
-        rBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
+        byte* rBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
+                DYNTYPE_TEMP);
+        byte* sBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
                 DYNTYPE_TEMP);
-        if (rBuf == NULL)
+
+        if (rBuf == NULL || sBuf == NULL)
             ret = WS_MEMORY_E;
-        if (ret == 0) {
-            sBuf = (byte*)WMALLOC(MAX_ECC_BYTES + ECC_MAX_PAD_SZ, heap,
-                    DYNTYPE_TEMP);
-            if (sBuf == NULL)
-                ret = WS_MEMORY_E;
-        }
+        else
 #else
-        byte rStore[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
-        byte sStore[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
-        byte* rBuf = rStore;
-        byte* sBuf = sStore;
+        byte rBuf[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
+        byte sBuf[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
 #endif
-
-        /* NULL only when a small-stack allocation above failed */
-        if (rBuf != NULL && sBuf != NULL) {
+        {
             ret = wc_ecc_sig_to_rs(asnSig, asnSigSz, rBuf, &rSz, sBuf, &sSz);
         }
         if (ret == 0) {
diff --git a/src/wolfsftp.c b/src/wolfsftp.c
index a5659c457..3f9b3a17d 100644
--- a/src/wolfsftp.c
+++ b/src/wolfsftp.c
@@ -4418,6 +4418,7 @@ int wolfSSH_SFTP_RecvWrite(WOLFSSH* ssh, int reqId, byte* data, word32 maxSz)
                     /* FXF_APPEND: the offset is ignored and the O_APPEND
                      * fd puts the write at EOF. pwrite() would honor the
                      * offset on every POSIX system but Linux. */
+                    /* cppcheck-suppress constStatement */
                     ret = WWRITE(ssh->fs, fd, (byte*)str + written,
                             strSz - written);
                 }

From 0f529945216ac2671895a241cb1abbd426cb702c Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Fri, 30 Oct 2026 15:29:30 -0700
Subject: [PATCH 2/2] Fail the cppcheck job on a finding

The cppcheck step pipes through tee, so its exit code was lost and the
job passed with findings. Run the step under bash, which sets pipefail,
and upload the results file only when the step fails.
---
 .github/workflows/cppcheck.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index c728a6b67..b90910570 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -24,6 +24,8 @@ jobs:
       - name: Run CppCheck
         id: cpp_check_run
         if: always()
+        # bash gets -o pipefail, so tee keeps cppcheck's exit code
+        shell: bash
         run: >
           cppcheck
           -UWSCPFILEHDR -UXSNPRINTF
@@ -41,7 +43,7 @@ jobs:
           3>&1 1>&2 2>&3 | tee cppcheck.txt
 
       - name: Upload cppcheck results as artifact
-        if: always()
+        if: failure() && steps.cpp_check_run.outcome == 'failure'
         uses: actions/upload-artifact@v7
         with:
           name: wolfssh-${{ github.sha }}-cppcheck_results.txt