asn: improve URI host extraction

[rizlik]

Description

Credit to Satoru Kanno (@satokan)

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Improves URI host extraction for ASN name-constraints by requiring a valid RFC 3986 scheme and only accepting an authority (//...) immediately after the scheme colon, preventing accidental host extraction from :// sequences later in the URI.

Changes:

• Added GetUriSchemeEnd() to validate scheme syntax and find the scheme colon.
• Updated GetUriHost() to use scheme-aware authority detection instead of scanning for :// anywhere.
• Expanded unit and API tests to cover scheme validation and “embedded URL” scenarios in paths/queries/fragments.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
wolfcrypt/src/asn.c	Adds scheme parsing helper and tightens authority/host detection to only the initial scheme delimiter.
tests/unit-mcdc/test_asn_ext_whitebox.c	Updates whitebox/MCDC coverage to directly exercise scheme parsing and the new authority guard.
tests/api/test_asn.c	Adds API-level regression tests for scheme syntax and ensuring later https://... substrings don’t affect host matching.

Suppressed comments (1)

wolfcrypt/src/asn.c:1

• GetUriSchemeEnd() relies on the loop condition to handle uriSz <= 0. Adding an explicit uriSz <= 0 early-return alongside the uri == NULL guard would make the contract clearer and keep the helper robust/consistent when called independently (e.g., from tests or future code paths).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11439

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +80 B (+0.1%, 67,039 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m3

• FLASH: .text +80 B (+0.1%, 125,855 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 205,021 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +64 B (+0.1%, 69,539 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +64 B (+0.0%, 178,968 B / 262,144 B, total: 68% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 187,260 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +64 B (+0.1%, 64,389 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 783,908 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 217,692 B / 262,144 B, total: 83% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 302,216 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 332,960 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +64 B (+0.1%, 64,389 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 126,643 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 242,703 B / 262,144 B, total: 93% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 205,021 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 303,112 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +128 B (+0.1%, 242,767 B / 262,144 B, total: 93% used)

linuxkm-pie

• Data: __patchable_function_entries +16 B (+0.1%, 27,064 B)

stm32-sim-stm32h753

• FLASH: .text +64 B (+0.0%, 188,668 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• linuxkm-standard