Validate response payload sizes in wh_client.c handlers

[yosuke-wolfssl]

Problem

wh_Client_RecvResponse() reports the received payload length but never validates it against the message the caller overlays on the comm buffer. The comm client reuses one buffer for request and response, so a short reply leaves the tail holding the client's own outbound request bytes: a truncated response reads back as a stale rc == 0 with a garbage id/counter, and the key-export paths copy out key material the frame never carried.

Separately, wh_CommClient_RecvResponse() copies the whole received payload into the buffer it is handed, with no bound on that buffer. Four handlers passed a small stack struct, so a reply larger than the struct overflows the stack before any size check the caller could add — wh_Client_KeyEvictResponse() copied up to WOLFHSM_CFG_COMM_DATA_LEN bytes over a 12-byte struct.

Fix (src/wh_client.c)

Handlers	Change
KeyExportResponse, KeyExportPublicResponse	size < sizeof(*resp) → rc → resp->len > (size - sizeof(*resp))
6 keystore + 4 counter fixed-size responses	size < sizeof(*resp) before reading rc
CommCloseResponse	resp_size != 0
CommInitResponse, CommInfoResponse, CustomCbResponse, KeyEvictResponse	receive into wh_CommClient_GetDataPtr() instead of a stack struct

Where rc lives inside the struct being validated, the checks split across a branch chain so the subtraction is guarded by a preceding sibling branch:

if (size < sizeof(*resp))                        { ret = WH_ERROR_ABORTED; }
else if (resp->rc != 0)                          { ret = resp->rc; }
else if (resp->len > (size - sizeof(*resp)))     { ret = WH_ERROR_ABORTED; }

Follow-up to #457, which applied this check to wh_client_she.c, and completes the wh_client.c handlers. KeyExportDmaResponse and the public-DMA path already validated an exact size and are unchanged.

Tests

test-refactor/misc/wh_test_client_malformed_resp.c drives the client against a raw whCommServer, so a reply can carry the correct kind and sequence while declaring a malformed size. Every bound is pinned from both sides — reject at capacity + 1, accept at exactly capacity. Oversized frames cover the four former stack callers.

Verification

• test-refactor with SHE=1: 44 passed, 0 failed. Legacy test/ exits 0. Clean under -std=c90 -Werror -Wall -Wextra.
• Every new guard mutation-checked (deleted, > → >=, > → <, and the stack-buffer fix reverted); each mutation fails the suite.

[Copilot]

Pull request overview

This PR hardens the wolfHSM client-side response handlers against malformed or truncated server replies by validating received payload sizes before parsing/copying, and by avoiding stack buffers in receive paths where the comm layer can memcpy unbounded payload sizes.

Changes:

• Update src/wh_client.c response handlers to (1) validate resp_size against the overlaid response struct before reading fields like rc, and (2) ensure variable-length payload claims (e.g., key export len) fit within the received frame.
• Move several response receives (CommInit/CommInfo/CustomCb/KeyEvict) to use the comm client’s internal data buffer (wh_CommClient_GetDataPtr) to prevent stack overflow from oversized frames.
• Add a new malformed-response regression test that drives the client against a raw comm server to inject short/oversized frames and verify handlers reject them safely.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/wh_client.c	Adds defensive response-size validation and switches vulnerable handlers to receive into the comm buffer to prevent stale reads and stack overflows.
test-refactor/misc/wh_test_client_malformed_resp.c	New test covering short/truncated fixed-size responses, key export length-vs-received checks, and oversized-frame handling for former stack receive sites.
test-refactor/wh_test_list.c	Registers the new malformed-response test in the misc test group.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #473

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

No new issues found in the changed files. ✅