[stenslae]

Description

• Moved wc_ForceZero() and wc_ConstantCompare() from memory.c into wc_port.c so they are always available across builds. The declarations, including the WOLFSSL_NO_FORCE_ZERO alias from 20261029-misc-fixes #11934, now are in wc_port.h, so the duplicate in wc_compat.h is dropped.
• Updated blake2 to use ForceZero() instead of hand rolled volatile loop.
• Export wc_BarrierDataSink() on every build. The portable WC_BARRIER_DATA() sink merged in ISO 19790 Zeroization for v7 #11434, but only on that arm; code including misc.c picks its arm from its own compiler and flags, so an MSVC/IAR or WOLFSSL_NO_ASM caller of a GCC-built library could fail to link.
• Stop settings.h from auto-defining WOLFSSL_NO_FORCE_ZERO / WOLFSSL_NO_CONST_CMP for minimal WOLFCRYPT_ONLY builds. SHA-1 (on by default) calls ForceZero(), so every build that heuristic fired on failed to link. Cost is under 200 bytes. WOLFSSL_USE_FORCE_ZERO is now a no-op.

A follow up PR will add disassembly DSE coverage for ForceZero.

Testing

Added regression tests.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text +16 B (+0.0%, 70,739 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text +12 B (+0.0%, 131,693 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: +4 B (+0.0%, 208,976 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-baremetal

• FLASH: +4 B (+0.0%, 73,467 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: +4 B (+0.0%, 181,655 B / 262,144 B, total: 69% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .rodata +4 B (+0.0%, 195,932 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: +4 B (+0.0%, 67,997 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 222,808 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

• FLASH: .rodata +4 B (+0.0%, 312,788 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-sp-math

• FLASH: +4 B (+0.0%, 67,997 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: +4 B (+0.0%, 132,437 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

• FLASH: +4 B (+0.0%, 249,510 B / 262,144 B, total: 95% used)

gcc-arm-cortex-m7

• FLASH: +4 B (+0.0%, 208,976 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

• FLASH: .rodata +4 B (+0.0%, 313,620 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: +4 B (+0.0%, 249,510 B / 262,144 B, total: 95% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-rsa-only
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[stenslae]

jenkins retest this please

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[stenslae]

jenkins retest this please

[stenslae]

jenkins retest this please

[philljj]

These two PRs are going to collide with same changes:

• misc: reject a negative length in ConstantCompare() #11561

[Copilot]

🟡 Changes recommended

The Arm Compiler 5 path still permits dead-store elimination, and the security hardening lacks regression coverage.

2 open findings

• Route Arm Compiler 5 wipes through the out-of-line sink · New
• Add optimized/LTO regression coverage for the DSE defense · New

3 resolved since last review

• Add regression coverage for dead-store elimination in portable buffer wipe
• Move implementation fixes to the unreleased changelog section
• Move new API notes to the unreleased changelog section

🧠 Review effort: Balanced

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

The security guarantee lacks permanent DSE/LTO regression coverage, and the changelog misdocuments armcc5 behavior.

2 open findings

• Add LTO/DSE regression coverage for the portable zeroing sink · New
• Document armcc5 exception to the portable sink and detection guidance · New

2 resolved since last review

• Route Arm Compiler 5 wipes through the out-of-line sink
• Add optimized/LTO regression coverage for the DSE defense

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The security and build regressions being fixed need automated coverage in this pull request.

1 open finding

• Add regression tests for memory-less and optimized portable barrier wipes · New

2 resolved since last review

• Add LTO/DSE regression coverage for the portable zeroing sink
• Document armcc5 exception to the portable sink and detection guidance

🧠 Review effort: Balanced

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: none
Unchanged since last review (not re-run): wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🔵 Needs a closer look

Security-sensitive, compiler-specific barrier behavior lacks the planned regression and DSE coverage.

0 open findings

1 resolved since last review

• Add regression tests for memory-less and optimized portable barrier wipes

🧠 Review effort: Balanced

[julek-wolfssl]

Once #11809 goes in the changes on this file will be redundant.

[stenslae]

claude @review

[Copilot]

🔵 Needs a closer look

The short-buffer alignment correction remains missing, and security-critical compiler barrier behavior needs final cross-toolchain validation.

1 open issue

• Guard ForceZero word-pointer conversion for short misaligned buffers · New

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .wolfssl_known_macro_extras, ChangeLog.md
Coverage: 3 of 8 in-scope changed file(s) opened by the reviewer; not opened: wolfcrypt/src/blake2b.c, wolfcrypt/src/blake2s.c, wolfcrypt/src/memory.c, wolfssl/wolfcrypt/blake2-impl.h, wolfssl/wolfcrypt/memory.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[stenslae]

Removed xfence barriers to keep this pr more focused.

[stenslae]

@claude review

[Copilot]

🟢 Approval recommended

No active review issues are reported for the helper-linkage and zeroization changes.

No open issues 🎉

1 resolved since last review

• Guard ForceZero word-pointer conversion for short misaligned buffers

_{Review effort: Balanced}

[claude]

Code review found no issues

No high-confidence issues detected in this change.

This review covers commit db5c8b6, which is no longer the latest commit on this pull request; later commits are not covered by it.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json, .wolfssl_known_macro_extras, ChangeLog.md, tests/api/test_port.h
Coverage: 2 of 5 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_port.c, wolfcrypt/src/memory.c, wolfssl/wolfcrypt/settings.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟢 Approval recommended

No active review issues are reported for the helper-linking and zeroization changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the changes addressing utility linking in minimal and memory-disabled wolfCrypt builds.

No open issues 🎉

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json, .wolfssl_known_macro_extras, ChangeLog.md, tests/api/test_port.h
Coverage: 3 of 5 in-scope changed file(s) opened by the reviewer; not opened: wolfcrypt/src/memory.c, wolfssl/wolfcrypt/memory.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[stenslae]

Rebased onto upstream and resolved merge conflicts.

[Copilot]

🟢 Approval recommended

No active review issues remain for the shared-helper portability changes.

No open issues 🎉

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json, .wolfssl_known_macro_extras, ChangeLog.md, tests/api/test_port.h
Coverage: 10 of 10 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

[Copilot]

🟢 Approval recommended

No active review issues are reported for the helper-linking and zeroization changes.

No open issues 🎉

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10935

Scan targets checked: wolfssl-src, wolfssl-bugs
Unchanged since last review (not re-run): wolfcrypt-src, wolfcrypt-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json, .wolfssl_known_macro_extras, ChangeLog.md, tests/api/test_port.h
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite