ASN template depth fix

[SparkiDev]

Description

Track the actual depth and compare to expected.
Added tests for this.

Testing

Added tests.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +76 B (+0.1%, 67,035 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m3

• FLASH: .text +72 B (+0.1%, 125,847 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 205,021 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +64 B (+0.1%, 69,539 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +64 B (+0.0%, 178,968 B / 262,144 B, total: 68% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 186,812 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +64 B (+0.1%, 64,389 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 783,268 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 217,692 B / 262,144 B, total: 83% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 301,704 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 332,512 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +64 B (+0.1%, 64,389 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 126,643 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +128 B (+0.1%, 242,255 B / 262,144 B, total: 92% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 205,021 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 302,664 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 242,255 B / 262,144 B, total: 92% used)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 49,808 B)

stm32-sim-stm32h753

• FLASH: .text +536 B (+0.3%, 189,116 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• linuxkm-pie

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11404

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 7
7 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11404

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11404

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

RSA regression checks expect the legacy error in template builds · Missing/incorrect platform conditionals

The new WOLFSSL_NO_DECODE_EXTRA branches expect ASN_RSA_KEY_E even with WOLFSSL_ASN_TEMPLATE. That decoder parses the full SPKI template, returns ASN_PARSE_E, and fails this valid build configuration.

Suggested fix: Expect ASN_PARSE_E when WOLFSSL_ASN_TEMPLATE is defined; use ASN_RSA_KEY_E only for the legacy no-decode-extra path.

[wolfSSL-Fenrir-bot]

RSA decoder ignores the BIT STRING content boundary · Logic errors

CheckBitString() discards the BIT STRING length, so RSAPublicKey integers are parsed beyond its declared content and malformed SPKI is accepted. Adjacent #11290 concerns GetAlgoIdImpl's AlgorithmIdentifier boundary.

Related known finding #11290 (similar but distinct): Both are legacy ASN.1 boundary-validation omissions, but #11290 parses AlgorithmIdentifier in GetAlgoIdImpl while this parses RSAPublicKey inside a BIT STRING in wc_RsaPublicKeyDecode_ex. The faulting nested structures and required bounds checks differ, so separate patches are required.

Suggested fix: Capture the BIT STRING length, bound the nested SEQUENCE and integers to its end, and require both nested structures to be exactly consumed.
Basis: RFC 3279 §2.3.1 specifies that the subjectPublicKey BIT STRING contains the DER-encoded RSAPublicKey value.

[wolfSSL-Fenrir-bot]

ECPrivateKey parameter wrapper length is discarded · Logic errors

The [0] length is parsed but discarded while algEndIdx remains seqEndIdx, allowing curve parameters to cross their ECPrivateKey wrapper. Adjacent #11292 is the same boundary class in a PKCS7 parser.

Related known finding #11290 (similar but distinct): Both discard an ASN.1 container boundary in asn_orig.c, but #11290 concerns AlgorithmIdentifier parsing in GetAlgoIdImpl whereas this concerns the explicit ECPrivateKey [0] parameters wrapper in wc_EccPublicKeyDecode. The operations, root parsing context, and fix locations differ.

Suggested fix: Compute the [0] content end, bound all named and explicit parameter parsing to it, and require exact consumption before parsing [1].
Basis: RFC 5915 §3 defines ECPrivateKey parameters as an explicitly tagged [0] ECParameters value with its own content boundary.