Bounds and input-validation hardening across ECC, PKCS#7, EVP, TLS 1.2 and ECH - #11484

Open

Frauschi wants to merge 6 commits into

wolfSSL:masterfrom

Frauschi:mem_fixes

Commits on Sep 17, 2026

tls13: base the ECH acceptance check on the handshake header, not the buffer
Frauschi
committed
e508667
Bound EVP_CipherUpdate output to inl + block size on decrypt
Frauschi
committed
0544944
pkcs7: bound the AuthEnvelopedData authTag copy by the remaining input
Frauschi
committed
845413c
tls: reject TLS 1.3 cipher suites below TLS 1.3 on the client
Frauschi
committed
bc4a912
ecc: bound explicit EC domain parameters to MAX_ECC_BYTES
Frauschi
committed
4d73099
ecc: bound X9.63 ordinates to the curve and range check SP points
Frauschi
committed
eda7614