Block cert modification in callbacks based on new flag

[padelsbach]

Description

Prevent the user from modifying certificates when those buffers are aliased across WOLFSSL and WOLFSSL_CTX objects. Specifically, the wolfSSL_CTX_use_certificate* and wolfSSL_CTX_user_PrivateKey* API families (and a few other one-offs) are blocked.

This is yet another approach to solving zd 22107

Testing

Added unit tests.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +100 B (+0.1%, 125,875 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4

• FLASH: .text +128 B (+0.1%, 205,085 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +128 B (+0.1%, 186,748 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +16 B, .text +192 B (+0.0%, 783,412 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 301,768 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 332,512 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 126,643 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +128 B (+0.1%, 242,255 B / 262,144 B, total: 92% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 205,021 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +128 B (+0.0%, 302,728 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +128 B (+0.1%, 242,319 B / 262,144 B, total: 92% used)

linuxkm-standard

• Data: __patchable_function_entries +32 B (+0.1%, 49,824 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• linuxkm-pie
• stm32-sim-stm32h753

[padelsbach]

jenkins retest this please

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11203

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src
Findings: 5
4 finding(s) posted as inline comments (see file-level comments below)

Required changes (1)

AltPrivateKey Id/Label loaders bypass the new in-callback guard

File: src/ssl_load.c:4600
Function: wolfSSL_CTX_use_AltPrivateKey_Id
Category: Use-after-free / double-free

wolfSSL_CTX_use_AltPrivateKey_Id and _Label free and replace ctx->altPrivateKey with no CheckCtxCertLoad call, unlike the PrivateKey_Id/_Label siblings this PR guards. Without WOLFSSL_BLIND_PRIVATE_KEY, ssl->buffers.altKey aliases that buffer (src/internal.c:7706), so an in-callback call frees key bytes live handshakes still read. Adjacent to known finding #8917, which covers the cross-thread reload race rather than the in-callback path.

Related known finding #13391 (similar but distinct): Both involve the AltPrivateKey ID/label replacement APIs and key-buffer replacement, but this is a callback-time aliased-buffer free caused by an omitted CheckCtxCertLoad call, whereas #13391 is a stale blinding-mask overread. They require separate guards and cleanup changes.

Recommendation: Call CheckCtxCertLoad(ctx) before FreeDer(&ctx->altPrivateKey) in both the alt Id and alt Label loaders.

Referenced code: src/ssl_load.c:4600-4602 (3 lines)

---

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Alternate private-key Id/Label setters bypass the new callback guard · Logic errors

The guard was added to wolfSSL_CTX_use_PrivateKey_Id/_Label but not to their alternate-key twins at ssl_load.c:4600 and ssl_load.c:4651, which also FreeDer(&ctx->altPrivateKey). Under WOLFSSL_DUAL_ALG_CERTS without blinding, ssl->buffers.altKey aliases that buffer (internal.c:7706), so calling either from an SNI or cert-setup callback frees what in-flight handshakes read.

Related known finding #13391 (similar but distinct): Both affect CTX primary/alternate key ID/label replacement setters in ssl_load.c, but this frees an aliased alternate-key buffer during a callback due to a missing guard, while #13391 retains a stale blinding mask after replacement. The configurations, faulting state, and fixes differ.

Fix: Add the same CheckCtxCertLoad(ctx) check to wolfSSL_CTX_use_AltPrivateKey_Id and wolfSSL_CTX_use_AltPrivateKey_Label before they free ctx->altPrivateKey.

[padelsbach]

fixed