Test Mutations, Unit tests, ForceZero Unification, and Fixes for wolfTPM#480

Merged

dgarske merged 37 commits intowolfSSL:masterfrom

aidangarske:fenrir-fixes-5

Apr 15, 2026

Commits on Apr 14, 2026

F-2944 - https://fenrir.wolfssl.com/finding/2944 - Validate validation.digest.size in TPM2_VerifySignature response parsing to prevent heap buffer overflow
aidangarske
committed
F-2946 - https://fenrir.wolfssl.com/finding/2946 - Validate authPolicy.size in wolfTPM2_SpdmConnectNuvoton and wolfTPM2_SpdmConnectNations to prevent stack buffer overflow
aidangarske
committed
F-2951 - https://fenrir.wolfssl.com/finding/2951 - Add unit test for SensitiveToPrivate pinning KDFa STORAGE and INTEGRITY labels with test vector
aidangarske
committed
F-2952 - https://fenrir.wolfssl.com/finding/2952 - Add unit test for wolfTPM2_PolicyAuthValue verifying auth placed at authDigestSz offset preserving HMAC key slot
aidangarske
committed
F-2953 - https://fenrir.wolfssl.com/finding/2953 - Add KDFa test vectors for ATH, SECRET, and DUPLICATE labels pinning TPM 2.0 spec-mandated session key derivation labels
aidangarske
committed
F-2958 - https://fenrir.wolfssl.com/finding/2958 - Add unit test for wolfTPM2_SetAuthHandle policyAuth branch verifying auth placed at authDigestSz offset
aidangarske
committed
F-2504 - https://fenrir.wolfssl.com/finding/2504 - Remove auth zero-padding in wolfTPM2_CreatePrimaryKey_ex to pass auth as-is matching wolfTPM2_CreateKey behavior
aidangarske
committed
F-2505 - https://fenrir.wolfssl.com/finding/2505 - Return BUFFER_E instead of silently truncating auth values in wolfTPM2_SetAuth, wolfTPM2_CreateKey, wolfTPM2_ChangeAuthKey, wolfTPM2_SetAuthHandle…
aidangarske
committed
F-2517 - https://fenrir.wolfssl.com/finding/2517 - Move auth size mismatch check outside DEBUG_WOLFTPM guard so it executes in all builds
aidangarske
committed
F-2531 - https://fenrir.wolfssl.com/finding/2531 - Add bounds checks for count and sizeofSelect in TPM2_Packet_AppendPCR matching parse-side validation
aidangarske
committed
F-2960 - https://fenrir.wolfssl.com/finding/2960 - Use TPM2_Packet_AppendSymmetric in TPM2_Duplicate to correctly handle TPM_ALG_NULL and TPM_ALG_XOR symmetric algorithms
aidangarske
committed
F-2956 - https://fenrir.wolfssl.com/finding/2956 - Fix wolfTPM2_PolicyHash boundary check from cc > TPM_CC_FIRST to cc >= TPM_CC_FIRST and add unit test covering cc=0, cc=TPM_CC_FIRST, and cc=TPM_C…
aidangarske
committed
F-2523 - https://fenrir.wolfssl.com/finding/2523 - Add ForceZero on NV auth password in wolfTPM2_NVCreateAuthPolicy on all exit paths
aidangarske
committed
F-2524 - https://fenrir.wolfssl.com/finding/2524 - Add ForceZero on NV write data buffer in wolfTPM2_NVWriteData before return
aidangarske
committed
F-2525 - https://fenrir.wolfssl.com/finding/2525 - Add ForceZero on NV read output buffer in wolfTPM2_NVReadAuthPolicy before return
aidangarske
committed
F-2526 - https://fenrir.wolfssl.com/finding/2526 - Add ForceZero on symmetric seed in wolfTPM2_ImportPrivateKey on all exit paths
aidangarske
committed
F-2528 - https://fenrir.wolfssl.com/finding/2528 - Add ForceZero on auth password in wolfTPM2_CreateLoadedKey on all exit path
aidangarske
committed
F-881 - https://fenrir.wolfssl.com/finding/881 - Remove dead code and redundant alreadyExists check in wolfTPM2_NVCreateAuthPolicy
aidangarske
committed
F-1228 - https://fenrir.wolfssl.com/finding/1228 - Add length check before accessing BIT STRING content in TPM2_ASN_DecodeX509Cert to prevent OOB read on zero-length fields
aidangarske
committed
F-1756 - https://fenrir.wolfssl.com/finding/1756 - Add NULL check for parent parameter in wolfTPM2_NVCreateAuthPolicy to prevent NULL pointer dereference
aidangarske
committed
F-1757 - https://fenrir.wolfssl.com/finding/1757 - Replace bitwise OR of TPM2_GetName return codes with sequential error checking in TPM2_CommandProcess
aidangarske
committed
F-2160 - https://fenrir.wolfssl.com/finding/2160 - Use clamped nonceCaller size in XMEMCPY in wolfTPM2_StartSession instead of original unclamped value
aidangarske
committed
F-2945 - https://fenrir.wolfssl.com/finding/2945 - Add TPM_ALG_NULL check before serializing inScheme details in TPM2_Certify, TPM2_CertifyCreation, TPM2_Quote, TPM2_GetSessionAuditDigest, TPM2_Get…
aidangarske
committed
F-2961 - https://fenrir.wolfssl.com/finding/2961 - Use TPM2_Packet_AppendSymmetric and TPM2_Packet_ParseSymmetric for SYMCIPHER case in AppendPublicParms and ParsePublicParms
aidangarske
committed
F-1763 - https://fenrir.wolfssl.com/finding/1763 - Add ForceZero on derived identity auth digest in wolfTPM2_SetIdentityAuth before return
aidangarske
committed
F-2162 - https://fenrir.wolfssl.com/finding/2162 - Add ForceZero on new auth password in wolfTPM2_ChangeAuthKey on all exit paths
aidangarske
committed
F-2163 - https://fenrir.wolfssl.com/finding/2163 - Add ForceZero on local keyBlob in wolfTPM2_LoadRsaPrivateKey_ex, wolfTPM2_LoadEccPrivateKey, and wolfTPM2_CreateAndLoadKey
aidangarske
committed
F-2167 - https://fenrir.wolfssl.com/finding/2167 - Add ForceZero on auth password in wolfTPM2_CreateKey on all exit paths
aidangarske
committed
F-2168 - https://fenrir.wolfssl.com/finding/2168 - Add ForceZero on auth password in wolfTPM2_CreatePrimaryKey_ex on all exit paths
aidangarske
committed
F-2966 - https://fenrir.wolfssl.com/finding/2966 - Add ForceZero on ECC private key in wolfTPM2_SpdmConnectNations error path after wc_ecc_export_public_raw failure
aidangarske
committed
F-2527 - https://fenrir.wolfssl.com/finding/2527 - Add ForceZero on PSS padded buffer in wolfTPM2_PK_RsaPssSign before scope exit
aidangarske
committed
F-2968 - https://fenrir.wolfssl.com/finding/2968 - Add ForceZero on auth in wolfTPM2_HmacStart on all exit paths
aidangarske
committed
F-2970 - https://fenrir.wolfssl.com/finding/2970 - Add ForceZero on key material at early return in wolfTPM2_LoadKeyedHashKey
aidangarske
committed
F-2971 - https://fenrir.wolfssl.com/finding/2971 - Add ForceZero on session auth in wolfTPM2_UnloadHandles before return
aidangarske
committed
Address review feedback
aidangarske
committed
F-2504 - https://fenrir.wolfssl.com/finding/2504 - Restore auth zero-padding in wolfTPM2_CreatePrimaryKey_ex and add matching padding to wolfTPM2_CreateKey and wolfTPM2_CreateLoadedKey for consiste…
aidangarske
committed
Address peer review
aidangarske
committed