Fix multiple Fenrir issues - #11181

Open

kareem-wolfssl wants to merge 14 commits into

wolfSSL:masterfrom

kareem-wolfssl:fbatch2

Commits on Aug 17, 2026

Refactor wolfSSL_EVP_DigestUpdate into a chunked function so sizes above word32 max are handled correctly. (F-7103)
kareem-wolfssl
committed
49633b7
Always use new key in wc_ecc_decrypt to avoid freeing passed in key. (F-7105)
kareem-wolfssl
committed
d5b45ed
Zero out the digest in SHA256/512 generation functions. (F-7135)
kareem-wolfssl
committed
3101dc7
Zero out SRP user and key when overwriting them. (F-7400)
kareem-wolfssl
committed
99dd673
Avoid suppressing errors from wc_RNG_GenerateBlock in wc_rng_bank_reseed. (F-7414)
kareem-wolfssl
committed
c5a97dd
Use subtraction-based comparison in EVP fillBuff. (F-7446)
kareem-wolfssl
committed
a9f7376
Correct decOidSz in wc_ecc_get_curve_id_from_oid. (F-7623)
kareem-wolfssl
committed
095808f
Avoid clamping in EncodeAttributes when attribute size exceeds capacity. (F-7624)
kareem-wolfssl
committed
0e8d9cc
Ensure wc_PKCS7_DecodeEnvelopedData outputSz matches what was actually written and does not exceed the given size. (F-7631)
kareem-wolfssl
committed
beae4ae
Clear hash in EVP_CIPHER_MD_CTX_copy_ex before all possible returns. (F-8166)
kareem-wolfssl
committed
59b5af0
Correct size documentation for wc_AesCfb1Encrypt and wc_AesCfb1Decrypt (bits not bytes). (F-9329)
kareem-wolfssl
committed
352b135
Correct encContentOut size in wc_PKCS7_EncodeContentStream.
kareem-wolfssl
committed
fd8a336
Code review feedback
kareem-wolfssl
committed
5e99f01
Correct ordering of added EVP_DigestUpdate checks to match OpenSSL's behavior.
kareem-wolfssl
committed
1469e23

Navigation Menu

Uh oh!

Fix multiple Fenrir issues - #11181

Fix multiple Fenrir issues#11181
kareem-wolfssl wants to merge 14 commits into
wolfSSL:masterfrom
kareem-wolfssl:fbatch2

Commits on Aug 17, 2026

Refactor wolfSSL_EVP_DigestUpdate into a chunked function so sizes above word32 max are handled correctly. (F-7103)

Always use new key in wc_ecc_decrypt to avoid freeing passed in key. (F-7105)

Zero out the digest in SHA256/512 generation functions. (F-7135)

Zero out SRP user and key when overwriting them. (F-7400)

Avoid suppressing errors from wc_RNG_GenerateBlock in wc_rng_bank_reseed. (F-7414)

Use subtraction-based comparison in EVP fillBuff. (F-7446)

Correct decOidSz in wc_ecc_get_curve_id_from_oid. (F-7623)

Avoid clamping in EncodeAttributes when attribute size exceeds capacity. (F-7624)

Ensure wc_PKCS7_DecodeEnvelopedData outputSz matches what was actually written and does not exceed the given size. (F-7631)

Clear hash in EVP_CIPHER_MD_CTX_copy_ex before all possible returns. (F-8166)

Correct size documentation for wc_AesCfb1Encrypt and wc_AesCfb1Decrypt (bits not bytes). (F-9329)

Correct encContentOut size in wc_PKCS7_EncodeContentStream.

Code review feedback

Correct ordering of added EVP_DigestUpdate checks to match OpenSSL's behavior.