Various hardening fixes and tests#535

Merged

dgarske merged 22 commits into

wolfSSL:masterfrom

aidangarske:fenrir-fixes-batch5

Jun 23, 2026

Commits on Jun 22, 2026

F-6318 - Validate priv size marker before read in readKeyBlob
aidangarske
committed
F-6310 - Enable Nuvoton GPIO pull-up by setting the bit
aidangarske
committed
F-6315 - Add testable swtpm response-size validation helper
aidangarske
committed
F-6319 - Clamp NV dataSize to digest buffer in secure_rot
aidangarske
committed
F-6320 - Zeroize GetRandom response buffer in TPM2_GetNonceNoLock
aidangarske
committed
F-4165 - Zeroize partial SPDM key material on derive failure
aidangarske
committed
F-5656 - Scrub wrapped private blob from CreateKey stack output
aidangarske
committed
F-5657 - Scrub wrapped private blob from CreateLoadedKey stack output
aidangarske
committed
F-5661 - Scrub sealed key blob from CreateKeySeal stack output
aidangarske
committed
F-6321 - Zeroize decrypted TPM response buffer in TPM2_SPDM_SendCommand
aidangarske
committed
F-5662 - Zeroize TIS transport tx/rx buffers after TPM traffic
aidangarske
committed
F-6312 - Clamp classic-arm inner size in TPM2_Packet_AppendSensitive
aidangarske
committed
F-6313 - Clear publicArea when ParsePublic reads zero size
aidangarske
committed
F-6316 - Add testable TIS response-size validation helper
aidangarske
committed
F-6317 - Add testable SPDM I/O response-size validation helper
aidangarske
committed
F-6322 - Correct ML-DSA sign sequence comments to streamable
aidangarske
committed
F-6314 - Add maximum-size TPM2B sensitive roundtrip test
aidangarske
committed
F-6311 - Prefer tpmrm0 with tpm0 fallback on Linux default
aidangarske
committed
F-6315 - Preserve SwTpmReceive error before response-size validation
aidangarske
committed
F-6318 - Return BUFFER_E on short private read in readKeyBlob
aidangarske
committed
F-6312 - Cover ECC, KEYEDHASH, SYMCIPHER arms in AppendSensitive clamp test
aidangarske
committed
F-6318 - Create readKeyBlob test files with owner-only permissions
aidangarske
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Various hardening fixes and tests#535

Various hardening fixes and tests#535
dgarske merged 22 commits into
wolfSSL:masterfrom
aidangarske:fenrir-fixes-batch5

Commits on Jun 22, 2026

F-6318 - Validate priv size marker before read in readKeyBlob

F-6310 - Enable Nuvoton GPIO pull-up by setting the bit

F-6315 - Add testable swtpm response-size validation helper

F-6319 - Clamp NV dataSize to digest buffer in secure_rot

F-6320 - Zeroize GetRandom response buffer in TPM2_GetNonceNoLock

F-4165 - Zeroize partial SPDM key material on derive failure

F-5656 - Scrub wrapped private blob from CreateKey stack output

F-5657 - Scrub wrapped private blob from CreateLoadedKey stack output

F-5661 - Scrub sealed key blob from CreateKeySeal stack output

F-6321 - Zeroize decrypted TPM response buffer in TPM2_SPDM_SendCommand

F-5662 - Zeroize TIS transport tx/rx buffers after TPM traffic

F-6312 - Clamp classic-arm inner size in TPM2_Packet_AppendSensitive

F-6313 - Clear publicArea when ParsePublic reads zero size

F-6316 - Add testable TIS response-size validation helper

F-6317 - Add testable SPDM I/O response-size validation helper

F-6322 - Correct ML-DSA sign sequence comments to streamable

F-6314 - Add maximum-size TPM2B sensitive roundtrip test

F-6311 - Prefer tpmrm0 with tpm0 fallback on Linux default

F-6315 - Preserve SwTpmReceive error before response-size validation

F-6318 - Return BUFFER_E on short private read in readKeyBlob

F-6312 - Cover ECC, KEYEDHASH, SYMCIPHER arms in AppendSensitive clamp test

F-6318 - Create readKeyBlob test files with owner-only permissions