Fix fenrir wolfTPM findings (3)

[aidangarske]

Description

Fix Fenrir findings #342, #536, #537, #538, #541, #542, #543, #544, #545, #546, #547, #878, #879, #880, #883, #884, #885, #886

[Copilot]

Pull request overview

Addresses multiple Fenrir wolfTPM findings by tightening bounds checks, improving input validation, and zeroizing sensitive structures after use.

Changes:

• Add size/NULL validation to prevent buffer overreads/overwrites (key blob parsing, session index checks, NVReadCert, RNG output size validation).
• Add explicit zeroization of sensitive intermediates (RSA/ECC private material, sensitive structs, command inputs).
• Adjust SwTPM send-command return-code initialization.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
src/tpm2_wrap.c	Adds bounds checks, session index validation, and sensitive memory zeroization in multiple key/crypto paths.
src/tpm2_swtpm.c	Changes default return code initialization in SWTPM command send path.
src/tpm2.c	Tightens RNG nonce-output size validation to prevent invalid lengths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.