Stop READTRUSTED transmitting unwritten response bytes

[yosuke-wolfssl]

Summary

The non-DMA READTRUSTED handler sized its response from a length the callee never
resolved. When wh_Server_CertReadTrusted() failed, no certificate data was staged, but
the handler still ran resp.cert_len = cert_len and
*out_resp_size = sizeof(resp) + resp.cert_len, so the server transmitted response-packet
bytes it had never written.

The handler's return code does not prevent this: wh_Server_HandleRequestMessage() always
sends the response regardless (src/wh_server.c:720-726), and the response packet is the
same buffer that carried the request, so the untouched region holds prior comm-buffer
contents.

Measured before the fix: a stored 8185-byte certificate produced resp_size = 8192 (the
whole comm buffer), of which 8184 bytes were never written. The correct response is the
8-byte header alone.

Addressed by f_6020.

Root cause

wh_Server_CertReadTrusted() returned WH_ERROR_BUFFER_SIZE before assigning
*inout_cert_len, contradicting its contract in wolfhsm/wh_server_cert.h:70-72, so the
handler had only the staging clamp to report. The handler then trusted that value
unconditionally, which also leaked on internal wh_Nvm_GetMetadata() and wh_Nvm_Read()
failures.

Fix

• wh_Server_CertReadTrusted() reports meta.len on both the success and BUFFER_SIZE
  paths, honouring its documented contract. The caller's buffer size is captured first so
  the size check is unaffected.
• The handler reports resp.cert_len only for outcomes that resolve a length (OK or
  BUFFER_SIZE), and adds the payload to *out_resp_size only on success. Every other
  outcome yields a header-only response.

Other callers (CertVerifyMultiRoot, CertVerifyAcert, the DMA handler) never read the
length on a failure return, so the contract change is safe for them.

Reachability

Requires a stored certificate larger than the staging clamp
min(WOLFHSM_CFG_MAX_CERT_SIZE, WOLFHSM_CFG_COMM_DATA_LEN - sizeof(ReadTrustedResponse)).
Whether a client can create that depends on config, since the add paths and the read clamp
are bounded differently: the DMA add reaches it in the shipping default
(COMM_DATA_LEN 1280, clamp 1272, DMA add up to 4096), and the inline add reaches it in the
test config (clamp 4096, inline add up to 8156). In a pure non-DMA build the inline add is
bounded below the clamp, so it is only reachable via out-of-band provisioning.

Tests

New test-refactor/server/wh_test_cert_readtrusted.c drives the handler directly against a
poisoned response packet, pinning the clamp from both sides: STAGED_LEN must read back
whole, STAGED_LEN + 1 must report the stored size with a header-only response and no byte
past the header touched. A second sub-test locks the WH_ERROR_ACCESS path to no length and
no payload.

_whTest_CertReadTrustedOverClamp in wh_test_client_certs.c covers the same contract
end-to-end at the client API, where the reported size is actually consumed. It picks
whichever add path can exceed the clamp for the active config and asserts such a window
exists rather than silently probing nothing. Gated on WOLFHSM_CFG_DMA.

Both the oversized and client tests were confirmed to fail against the unfixed server, so
they are negative controls. The ACCESS test passes either way and is kept as a
forward-looking guard.

Verification

test-refactor default (34 passed, 0 failed) and DMA=1 ASAN=1 (38 passed, 0 failed). Legacy test/ suite unchanged and passing.

Scope

READTRUSTED_DMA is out of scope: it answers with whMessageCert_SimpleResponse, which has
no cert_len field, so the stored length cannot be returned there. Its stale comment is
corrected to record that; extending the DMA response is separate work.

[Copilot]

Pull request overview

This PR fixes an information-leak/response-corruption issue in the non-DMA READTRUSTED certificate handler where the server could transmit bytes from the shared comm buffer that were never written (e.g., after failures), by tightening length reporting and response sizing. It also updates wh_Server_CertReadTrusted() to honor its documented contract by reporting the stored certificate length on both success and WH_ERROR_BUFFER_SIZE.

Changes:

• Update wh_Server_CertReadTrusted() to always report meta.len via *inout_cert_len, including on WH_ERROR_BUFFER_SIZE.
• Fix non-DMA READTRUSTED response construction to only include payload bytes in *out_resp_size on success, and only set resp.cert_len when a length is actually resolved.
• Add targeted regression tests (server handler-level poisoning test + client API end-to-end coverage under DMA).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/wh_server_cert.c	Fixes the wh_Server_CertReadTrusted() length contract and prevents unwritten comm-buffer bytes from being included in READTRUSTED responses.
test-refactor/server/wh_test_cert_readtrusted.c	Adds direct handler tests that poison the response packet and assert header-only sizing/no writes past header on non-success paths.
test-refactor/client-server/wh_test_client_certs.c	Adds DMA-gated end-to-end client test asserting the reported stored length is preserved on WH_ERROR_BUFFER_SIZE.
test-refactor/wh_test_list.c	Registers the new whTest_CertReadTrusted test in the server test group.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #459

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

No new issues found in the changed files. ✅