From a9a4e6839da4698cdeceef022f71a3b968ae7ebc Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Fri, 18 Sep 2026 11:49:18 -0700
Subject: [PATCH 1/2] internal: drop the unreachable format reject

wolfSSH_ProcessBuffer() rejects any format outside ASN1, PEM, RAW, and
OPENSSH before the decode chain runs, so the chain's trailing else could
never be reached. PEM becomes the chain's default arm, which keeps derSz
definitely assigned on every path into the decrypt step.

Issue: CID-653252
---
 src/internal.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/internal.c b/src/internal.c
index 371a67008..25313c8f8 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -3353,7 +3353,8 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx,
             derSz = inSz;
         }
     }
-    else if (format == WOLFSSH_FORMAT_PEM) {
+    /* WOLFSSH_FORMAT_PEM; the format check above admits no other value. */
+    else {
     #ifdef WOLFSSH_CERTS
         if (type == BUFTYPE_CA) {
             /* A CA buffer may hold a bundle, so every block is loaded. */
@@ -3401,9 +3402,6 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx,
         }
         derSz = (word32)ret;
     }
-    else {
-        return WS_UNIMPLEMENTED_E;
-    }
 
     /* Maybe decrypt */
 

From cb6cbf983776d85da44eb7f07ef62b844f6b570f Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Fri, 18 Sep 2026 11:49:18 -0700
Subject: [PATCH 2/2] tests: drop the dead descriptor restore results

The done: block in test_SendChannelTerminalRequestNoTty() is only
entered with a descriptor still open on a path that already set an error
code, so the result checks guarding -1494 and -1495 could never be true.
Restore the descriptors and keep the original code.
---
 tests/unit.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tests/unit.c b/tests/unit.c
index dc07c65d2..daf45b546 100644
--- a/tests/unit.c
+++ b/tests/unit.c
@@ -11227,14 +11227,15 @@ static int test_SendChannelTerminalRequestNoTty(void)
     }
 
 done:
+    /* Only reached with a descriptor still open on an already-failed path, so
+     * restore it but keep the original error code. Unlike the TERM block
+     * below, a result check here would never be true. */
     if (stdinCopy >= 0) {
-        if (dup2(stdinCopy, STDIN_FILENO) < 0 && result == 0)
-            result = -1494;
+        (void)dup2(stdinCopy, STDIN_FILENO);
         close(stdinCopy);
     }
     if (stdoutCopy >= 0) {
-        if (dup2(stdoutCopy, STDOUT_FILENO) < 0 && result == 0)
-            result = -1495;
+        (void)dup2(stdoutCopy, STDOUT_FILENO);
         close(stdoutCopy);
     }
     if (termPinned) {