[ohki-saito]

Description

Fenrir Finding F-8873

wolfSSL_CTX_ctrl(SSL_CTRL_CHAIN) (used by SSL_CTX_set0_chain / SSL_CTX_set1_chain) only logged errors from wolfSSL_CTX_add_extra_chain_cert() and still returned success. This left ctx->certChain (DER) and ctx->x509Chain (X509) inconsistent. A failed wolfSSL_X509_up_ref() also still called wolfSSL_CTX_add_extra_chain_cert(), which could consume the stack's own reference.

Changes:

• Return WOLFSSL_FAILURE if a certificate is NULL, its reference count cannot be increased, or it cannot be added to the chain.
• Stop before adding a certificate when up_ref fails, so the stack's reference is never consumed.
• Take ownership of sk only on success. On failure, free the previous chain and clear both ctx->certChain and ctx->x509Chain; the caller still owns sk.

Testing

Added test_wolfSSL_CTX_set0_chain_bad_cert: sets a valid chain, then a chain containing an empty X509, and checks that the call fails and leaves both ctx->certChain and ctx->x509Chain NULL.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Copilot]

🟡 Changes recommended

Failure cleanup leaves a stale chain count that can cause a TLS 1.3 crash, and the regression test needs a PEM feature guard.

2 open issues

• Reset certChainCnt when discarding partial certificate chain · New
• Guard PEM-dependent test with WOLFSSL_PEM_TO_DER · New

What changed in this PR

This PR tightens error handling in wolfSSL’s OpenSSL-compatible chain setter so failed certificate additions report failure rather than leaving inconsistent chains.

Changes:

• Reject NULL certificates, failed reference increments, and failed chain additions.
• Transfer stack ownership only on success and clear chain buffers on failure.
• Add a regression test for replacing a valid chain with one containing an empty certificate.

File	Description
tests/​api/​test_ssl_cert.h	Declares and registers the regression test.
tests/​api/​test_ssl_cert.c	Tests failure reporting and chain cleanup.
src/​ssl.c	Updates SSL_CTRL_CHAIN error handling and ownership logic.

_{Review effort: Balanced}

[ohki-saito]

Addressed both review comments:

• Reset ctx->certChainCnt when discarding the partial DER chain and
  assert it in the test.
• Require WOLFSSL_PEM_TO_DER for the new test.

[dgarske]

Okay to test

[github-actions]

retest this please