[yosuke-wolfssl]

Problem

_Ed25519MakeKey() validated the server-declared res->outSz against
WOLFHSM_CFG_COMM_DATA_LEN — the compile-time size of the comm buffer —
rather than against the number of bytes actually received. A malicious or
malfunctioning server could return a short frame (e.g. generic header only)
while declaring a large outSz; the client then deserialized stale
comm-buffer bytes as Ed25519 key material. The same frame also left
res->keyId and res->outSz read from beyond the received data.

Fix (src/wh_client_crypto.c)

Bound the response against res_len, the length reported by
wh_Client_RecvResponse(), before any field of the response struct is read:

const size_t hdr_sz =
    sizeof(whMessageCrypto_GenericResponseHeader) + sizeof(*res);

/* Defensive bound: res->outSz must fit within the received frame */
if (res_len < hdr_sz || res->outSz > (res_len - hdr_sz)) {
    return WH_ERROR_ABORTED;
}

• res_len < hdr_sz rejects frames too short to hold the response struct,
  and is evaluated first so the subtraction cannot wrap.
• Placed ahead of the field reads, so res->keyId is no longer read from a
  frame that never arrived. The removed check sat inside
  if (key != NULL) { if (res->outSz > 0) {, so it never ran on the
  cache-only path.

This matches the equivalent checks already on main in _HkdfMakeKey() and
_CmacKdfMakeKey().

Closes f-5461.

Verification

• Rebased onto main. Builds clean under -Werror -Wall -Wextra.
• test-refactor suite: 45 passed, 26 skipped, 0 failed of 71.

[Copilot]

Pull request overview

This PR hardens the client-side crypto key-generation response handling by validating server-declared payload lengths against the actual received frame length, preventing stale bytes in the comm buffer from being deserialized as key material (notably on short/generic-header-only responses).

Changes:

• Add received-frame-length bounds checks to Curve25519 and Ed25519 keygen response parsing in src/wh_client_crypto.c.
• Introduce a POSIX-only “malformed response” regression test using a fake comm-layer server that sends truncated/oversized-declared frames.
• Register the new POSIX-port-owned test in the POSIX test runner so it runs before the real server thread starts.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/wh_client_crypto.c	Adds defensive checks ensuring res->len/outSz fits within the received response frame before any response-body reads/deserialization.
test-refactor/posix/wh_test_malformed_response.c	New negative-path test that injects malformed response lengths via a fake comm server and asserts WH_ERROR_ABORTED across keygen algorithms.
test-refactor/posix/wh_test_posix_main.c	Registers and runs the new malformed-response test in the pre-server “misc” slot to avoid overlapping the real server.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #465

Scan targets checked: wolfhsm-crypto-bugs, wolfhsm-src

No new issues found in the changed files. ✅