[dgarske]

Description

Three loops read an element before checking that its index was in range:

• esp_clean_result() in the ESP32 math port: read one digit past the array, and was bounded by a fixed 128 rather than the number's allocated size. It now uses Z->size with SP math and FP_SIZE with fast math, and checks the bound first.
• show_macro() in the ESP32 utilities: checked the bound last. No out-of-bounds access was possible here, as the input is a terminated string.
• _write() in the IoT-Safe example: read one byte past a buffer with no terminator.

Fixes ZD22754. Reported by Md. Raisul Islam Mobin (https://mobin.tech | @mobin2021).

Testing

The reporter's harness under AddressSanitizer reports each read with the old conditions and none with the new ones. Not built for ESP32 or the IoT-Safe target: no toolchain for either was available.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the bounds-check ordering and ESP32 cleanup-limit changes.

No open issues 🎉

What changed in this PR

This PR fixes bounds-check ordering in the ESP32 port and IoT-Safe example, preventing reads past numeric and output buffers.

Changes:

• Check array and buffer bounds before reading elements in three loops.
• Bound ESP32 math cleanup by the number’s capacity rather than a fixed 128-digit limit.
• Reorder the ESP32 string-loop checks defensively; terminated inputs were already safe.

File	Description
wolfcrypt/​src/​port/​Espressif/​esp32_util.c	Check the string-copy limit before reading characters.
wolfcrypt/​src/​port/​Espressif/​esp32_mp.c	Use the digit capacity and check bounds before reading during cleanup.
IDE/​iotsafe/​devices.c	Check the output-buffer boundary before dereferencing the pointer.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12045

Scan targets checked: wolfcrypt-port-bugs
Not reviewed (no scan target covers them): IDE/iotsafe/devices.c
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max