Fenrir fixes 2026 06 10#792

Merged

mattia-moffa merged 37 commits into

wolfSSL:masterfrom

danielinux:fenrir-fixes-2026-06-10

Jun 11, 2026

Commits on Jun 10, 2026

F-4782: bound hdr->pos in bitmap_put to prevent OOB write from corrupted vault
danielinux
committed
F-4717: reject PCI BARs whose region overruns the pool to prevent cursor wrap
danielinux
committed
F-4716: reject SDHCI block addresses that overflow 32-bit SD command argument
danielinux
committed
F-4715: bound GPT partition-entry array size before CRC scan in disk_open
danielinux
committed
F-4714: compute GPT header offset in 64 bits to prevent uint32_t overflow
danielinux
committed
F-4692: guard squashelf segment-offset alignment against integer overflow
danielinux
committed
F-4651: bound multiboot2 header_length to prevent OOB tag walk
danielinux
committed
F-4339: widen uart-flash-server bounds checks to 64-bit to stop uint32_t wrap
danielinux
committed
F-4258: reject GPT partitions whose LBA extent overflows uint64_t
danielinux
committed
F-5747: guard fdt_data_size_ and fdt_splice_string_ against off_dt_strings+size_dt_strings uint32_t overflow
danielinux
committed
F-5745: fix off-by-one in hal_flash_erase skipping last page when len%PAGE_SIZE!=0
danielinux
committed
F-5357: zeroize digest and uuid_be stack buffers in hal_uds_derive_key before every return
danielinux
committed
F-5351: test wolfBoot_open_self_address rejects bad magic with hdr_ok cleared
danielinux
committed
F-5348: always evaluate keyslot_CT_hint_matches for every slot
danielinux
committed
F-5093: fix OOB memset in x86_paging_setup_ptp and non-looping panic
danielinux
committed
F-5092: fix off-by-one in fwtpm_nv_read/write/erase offset guard
danielinux
committed
Fix fwTPM unit test CI config
danielinux
committed
Guard mcxn UDS zeroize helper
danielinux
committed
F-4972: zeroize stack wc_MlDsaKey after Free in keygen_ml_dsa cleanup
danielinux
committed
F-4971: zeroize stack ed448_key after Free in keygen_ed448 cleanup
danielinux
committed
F-4970: zeroize stack ecc_key after Free in keygen_ecc cleanup
danielinux
committed
F-4969: zeroize stack RsaKey after FreeRsaKey in keygen_rsa cleanup
danielinux
committed
F-4966: fix nwords=0 truncation on sub-word write to 16-bit NOR flash
danielinux
committed
F-4788: zeroize stack ed25519_key after Free in keygen_ed25519 cleanup
danielinux
committed
F-4786: fix delta_base_version LE decode in base_diff for big-endian hosts
danielinux
committed
F-4784: erase psa_store object data on write-mode open to clear residual key material
danielinux
committed
F-4649: erase pkcs11_store object sectors on write-mode open to clear residual key material
danielinux
committed
F-4647: bound strlen to ATA_SECURITY_PASSWORD_LEN in passphrase path
danielinux
committed
F-4420: zeroize XmssKey on all error paths in keygen_xmss
danielinux
committed
F-4419: zeroize LmsKey on all error paths in keygen_lms
danielinux
committed
F-4418: fix BSS-clear collision guard to use mem_size instead of file_size
danielinux
committed
F-4414: replace strtol with strtoul for fw_version to fix saturation on 32-bit-long platforms
danielinux
committed
F-4412: add equal-version emergency rollback test to pin >= operator
danielinux
committed
Handle fdt splice size errors (addressed Mattia's comment)
danielinux
committed
Preserve neighboring store objects on truncate (addressed Fenrir's
danielinux
committed
Fix x86 FSP freestanding build regressions
danielinux
committed
Revert misguided secret_size guard in sata_unlock_disk
danielinux
committed