lib: accept larger input to md5/hmac/sha256/sha512 functions

[bagder]

Avoid unchecked data conversions from size_t to unsigned int.

Reported-by: James Fuller

[Copilot]

Pull request overview

This PR aims to make internal digest/HMAC helpers safely handle inputs larger than what underlying hash update APIs accept, avoiding unchecked size_t → unsigned int conversions.

Changes:

• Update MD5/SHA256/HMAC “one-shot” helpers to accept size_t lengths and process input in chunks.
• Adjust HMAC update API to return void and add a guard for oversized HMAC keys.
• Chunk wolfSSL SHA-512/256 update calls to avoid truncating large input sizes.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
lib/sha256.c	Switches Curl_sha256it() to chunk input rather than casting size_t to unsigned int.
lib/md5.c	Switches Curl_md5it() to chunk input rather than casting size_t to unsigned int.
lib/hmac.c	Updates HMAC update signature and chunks Curl_hmacit() input; adds keylen > UINT_MAX guard.
lib/curl_sha512_256.c	Chunks wolfSSL SHA-512/256 update calls to avoid truncation for large size_t lengths.
lib/curl_hmac.h	Updates prototypes to match HMAC API changes (Curl_HMAC_update return type; Curl_hmacit datalen type).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bagder]

Good bot. That was simply a too naive fix...

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: This PR hardens the internal MD5/HMAC/SHA256/SHA512-256 helpers to safely accept inputs larger than what fits in an unsigned int, avoiding unchecked truncating conversions.

Changes:

• Adjust digest helper APIs to take size_t lengths where appropriate (Curl_md5it, Curl_sha256it, Curl_hmacit).
• Chunk large inputs into bounded pieces before calling underlying *Update routines that take smaller integer sizes.
• Simplify Curl_HMAC_update to return void since it never had a meaningful return value.
• Reject impossible HMAC key sizes that don’t fit in unsigned int to prevent silent truncation.

Technical Notes: The new loops repeatedly feed UINT_MAX-sized chunks and advance the input pointer until the full size_t length is consumed.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.