Size ENCRYPT_LEN for both (EC)DHE-PSK pre-master secret length fields

[gasbytes]

Description

ENCRYPT_LEN covers both 2-byte length prefixes, so a max-size DH prime plus a max-length PSK fits the buffer.

Thanks to Anthropic for the report.

Testing

Added associated regression test (test_tls12_dhe_psk_max_pms).

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟡 Changes recommended

Critical buffer-sizing and regression-coverage issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes TLS 1.2 (EC)DHE-PSK pre-master-secret buffer sizing and adds a maximum-size regression test.

Changes:

• Accounts for both 2-byte length prefixes in ENCRYPT_LEN.
• Adds and registers maximum-size DHE-PSK test coverage.

File summaries

File	Summary	Review status
wolfssl/internal.h	Adjusts pre-master-secret buffer sizing.	Critical: May underallocate for 16384-bit DH configurations.
tests/api/test_tls.h	Declares and registers the regression test.	Reviewed.
tests/api/test_tls.c	Implements maximum-size DHE-PSK coverage.	Critical: Test is skipped for supported maximum sizes beyond the listed fixtures.

Review details

Suppressed comments (1)

tests/api/test_tls.c:652

• TEST_TLS12_DHE_PSK_DH_FILE enables code that calls file-based DH setup, the client/server TLS 1.2 method APIs, and the default RSA certificate fixture. Its current definition is not gated for NO_FILESYSTEM/NO_CERTS/PEM-disabled, client/server-disabled, or NO_RSA builds, so reduced configurations can fail to compile, link, or initialize this test. Gate the fixture macro on those prerequisites (or provide buffer-based fixtures).

#if MAX_DHKEY_SZ == 512
    #define TEST_TLS12_DHE_PSK_DH_FILE "./certs/dh4096.pem"
#elif MAX_DHKEY_SZ == 384
    #define TEST_TLS12_DHE_PSK_DH_FILE "./certs/dh3072.pem"
#elif MAX_DHKEY_SZ == 256
    #define TEST_TLS12_DHE_PSK_DH_FILE "./certs/dh2048.pem"
#endif

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753