Fix multiple Fenrir issues

[kareem-wolfssl]

Description

Fixes F-7103, F-7105, F-7135, F-7400, F-7414, F-7446, F-7623, F-7624, F-7631, F-8166, F-9329

Testing

Built in tests + added tests

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR addresses a set of reported “Fenrir” issues across the wolfCrypt and OpenSSL-compat layers, focusing on correctness fixes (buffer bounds, memory lifecycle, and API sizing) and adding regression tests to prevent reintroductions.

Changes:

• Align EVP DigestSignUpdate/DigestUpdate handling with size_t semantics and harden digest update behavior for large inputs.
• Fix/strengthen memory and bounds handling in SRP, PKCS7 (attributes + streaming), ECC ECIES decrypt behavior, and RNG/DRBG zeroization paths.
• Add targeted regression and boundary tests for PKCS7 streaming/attribute limits, ECC decrypt pubKey preservation, and SRP overwrite cleanup.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
wolfssl/openssl/evp.h	Updates OpenSSL-compat EVP_DigestSignUpdate prototype to use size_t.
wolfcrypt/src/evp.c	Refactors EVP digest update/sign/verify update behavior (chunking, HMAC path handling, memcpy safety).
wolfcrypt/src/srp.c	Ensures prior username/key buffers are freed and zeroized on overwrite to avoid leaks.
wolfcrypt/src/rng_bank.c	Simplifies reseed error handling to return any non-zero reseed result.
wolfcrypt/src/random.c	Adds tracking and explicit zeroization of DRBG digest temporaries.
wolfcrypt/src/pkcs7.c	Enforces attribute-array bounds, fixes streaming encode buffer sizing, and hardens streamed BER decode output bounds/overflow.
wolfcrypt/src/ecc.c	Prevents wc_ecc_decrypt() from freeing/overwriting a caller-supplied pubKey in default ECIES message format.
wolfcrypt/src/aes.c	Clarifies AES CFB1 doc comments about bit-length processing and buffer sizing.
wolfcrypt/test/test.c	Adds SRP regression coverage and PKCS7 auth/unauth attribute boundary regression test.
tests/api/test_pkcs7.h	Registers new PKCS7 streaming chunk boundary test.
tests/api/test_pkcs7.c	Adds BER multi-segment decode bounds regression and streaming encoder boundary tests.
tests/api/test_ecc.h	Registers new ECC decrypt pubKey preservation test.
tests/api/test_ecc.c	Adds ECC decrypt pubKey preservation regression and long-OID decode boundary test.
doc/dox_comments/header_files/ecc.h	Updates ECC decrypt Doxygen to reflect that pubKey is ignored/unchanged in the default message format.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +12 B (+0.0%, 66,971 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m3

• FLASH: .text +8 B (+0.0%, 125,783 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 783,268 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +128 B (+0.1%, 217,756 B / 262,144 B, total: 83% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 242,191 B / 262,144 B, total: 92% used)

linuxkm-pie

• Data: __patchable_function_entries +8 B (+0.0%, 27,008 B)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 49,800 B)

stm32-sim-stm32h753

• FLASH: .text +128 B (+0.1%, 188,708 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11181

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 11
11 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[philljj]

Some of the Fenrir findings look valid.

Also, check with Douzzer on the rng_bank change.

[kareem-wolfssl]

Jenkins retest this please

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11181

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[philljj]

Tests good with multi-test with:

• all-gcc-c89
• all-c89-clang-tidy
• defaults-openssl-coexist-fips-v2
• quantum-safe-wolfssl-all-smallstack-clang-tidy
• quantum-safe-wolfssl-all-noasm-smallstack-sanitizer
• quantum-safe-wolfssl-all-intelasm-sp-asm-[valgrind, sanitizer, clang-sanitizer]
• linuxkm-fips-dev-module-update-fips-hash-intelasm-LKCAPI-insmod