[miyazakh]

Description

• F-10018 / F-16709: The DER ECDSA signature was converted to raw r||s using fixed offsets in wc_tsip_EccVerify and wc_tsip_tls_CertVerify. A short or malformed signature caused an out-of-bounds read, and a valid signature with a 31-byte r or s was converted incorrectly. Both functions now use a common helper based on wc_ecc_sig_to_rs that strips leading zeros, rejects components longer than 32 bytes, and right-aligns r and s.
• F-17020: tsip_VerifyEcdsa did not check that the key curve matched the wrapped TSIP key type, so a P-521 key overflowed the 48-byte hash buffer. A mismatched curve, a missing key/dp, or an oversized curve now returns CRYPTOCB_UNAVAILABLE so verification falls back to software.
• F-17015: tsip_Tls13HandleFinished passed the server Finished body to TSIP without checking its length, before the software size checks in DoTls13Finished. TSIP supports SHA-256 suites only, so any Finished that is not 32 bytes is now rejected with BUFFER_ERROR.

ChangeLog entries are maintained separately and are not included in this PR.

Testing

• Host-side ASan harnesses that compile the affected functions from the source and stub the TSIP driver: confirmed the out-of-bounds read/write before the fix and correct behavior after it (short/truncated DER, 31/32/33-byte r and s, curve mismatch, 0/16/32/40-byte Finished).
• RX72N EnvisionKit: wolfCrypt test, benchmark, and TLS 1.3 connections with ECC and RSA certificates pass.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

The TSIP conversion lacks committed regression tests through both verification entry points covering truncated DER, sign-padding zeros, and 31/32/33-byte components, with assertions for exact raw output and rejection before driver invocation.

1 open issue

• Add regression tests for DER-to-TSIP conversion entry points · New

What changed in this PR

This PR hardens input validation in wolfSSL’s Renesas TSIP port, addressing unsafe signature conversion, curve mismatches, and invalid TLS 1.3 Finished lengths.

Changes:

• Replaces fixed-offset ECDSA signature conversion with a shared DER parser that validates component sizes and right-aligns the output.
• Checks ECC key metadata, curve compatibility, and size before hardware verification, allowing software fallback when unsupported.
• Rejects Finished messages that are not 32 bytes before passing them to TSIP.

File	Description
wolfcrypt/​src/​port/​Renesas/​renesas_tsip_util.c	Adds shared signature parsing, ECC curve validation, and Finished-length checks.

_{Review effort: Balanced}