Fix PKCS7 streamed SignedData dropping content

[aidangarske]

wc_PKCS7_EncodeContentStreamHelper() initializes ret to BAD_FUNC_ARG and, in the WC_CIPHER_NONE case, only assigns it inside if (esd->contentDigestSet != 1). When the caller passes a precomputed hash to wc_PKCS7_EncodeSignedData_ex(), contentDigestSet is 1, so that branch is skipped, ret keeps BAD_FUNC_ARG, and the if (ret == 0) block that writes the content never runs. PKCS7_EncodeSigned() does not check the return value, so encoding reports success while emitting a bundle with an empty eContent.

Found with wolfssl-examples pkcs7/signedData-stream, which failed verification with ASN_PARSE_E (-140). OpenSSL rejected the same bundle with CMS Verification failure, confirming the bundle was malformed rather than wolfSSL being strict.

With the fix the bundle grows by the 32 bytes that were missing (2 byte OCTET STRING header plus 30 bytes of content), and it verifies with both wolfSSL and openssl cms -verify.

testwolfcrypt and tests/unit.test pass.

[Copilot]

Pull request overview

Fixes a logic error in PKCS7 streamed SignedData encoding where wc_PKCS7_EncodeContentStreamHelper() could leave ret as BAD_FUNC_ARG in the WC_CIPHER_NONE path when the content digest was precomputed (or when esd is NULL), preventing the eContent bytes from being written despite overall encoding succeeding.

Changes:

• Ensure wc_PKCS7_EncodeContentStreamHelper() returns success (ret = 0) for WC_CIPHER_NONE when no hashing update is needed (contentDigestSet == 1) or when esd is not provided.
• As a result, the if (ret == 0) block that emits the OCTET STRING header and content now runs correctly in these cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-pkcs7

• FLASH: .text -64 B (-0.0%, 212,716 B / 262,144 B, total: 81% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Frauschi]

Jenkins retest this please

[Frauschi]

LGTM