20260602-FPKI-DecodeGeneralName-URI

[douzzer]

wolfcrypt/src/asn.c: don't disable URI validation in DecodeGeneralName() and DecodeAcertGeneralName() when defined(WOLFSSL_FPKI).

tests/api/test_certman.c: fix uriSan in test_wolfSSL_X509_check_host_URI_SAN_not_DNS_match() (make it a URI).

tests/api.c: align gating in test_wolfSSL_URI() with new dynamics (URIs validated regardless of defined(WOLFSSL_FPKI)).

detected and tested with

wolfssl-multi-test.sh ...
old-valgrind-config-sanitizer
check-source-text
clang-tidy-all-sp-all

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10578

Scan targets checked: wolfcrypt-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 2

Medium (2)

URI slash error path reads past payload

File: wolfcrypt/src/asn.c:18663
Function: DecodeGeneralName
Category: Logic errors

DecodeGeneralName() now enables this validator for WOLFSSL_FPKI, but the / path sets i = len inside the for; the loop increment makes i > len, so the later URI check reads past the GeneralName payload.

Recommendation: Return ASN_ALT_NAME_E immediately on /, or break using a separate malformed flag instead of mutating i.

Referenced code: wolfcrypt/src/asn.c:18663-18667 (5 lines)

---

ACERT URI slash error path reads past payload

File: wolfcrypt/src/asn.c:37745
Function: DecodeAcertGeneralName
Category: Logic errors

DecodeAcertGeneralName() now enables this validator for WOLFSSL_FPKI, but the / path sets i = len inside the for; the loop increment makes i > len, so the later URI check reads past the GeneralName payload.

Recommendation: Return ASN_ALT_NAME_E immediately on /, or break using a separate malformed flag instead of mutating i.

Referenced code: wolfcrypt/src/asn.c:37745-37749 (5 lines)

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-tls12

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10578

Scan targets checked: wolfcrypt-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[douzzer]

retest this please
(Jenkins glitch)

[Frauschi]

The changes to test_certman.c conflict with #10573 (I thought that the missing http:// has been intentional). I'll close #10573 if your approach is the right one.