[douzzer]

src/xmalloc.c: size the SHA slots by wolfSSL's transform-scratch constants

wolfSSL's SHA-256 C transform now takes a caller-owned scratch struct (message schedule plus working variables) allocated once per Update/Final call under WOLFSSL_SMALL_STACK, sized WC_SHA256_TSCRATCH_SIZE (288 bytes) rather than one 256-byte block of schedule per transform. The static sha_block slot, pinned at HASH_BLOCK_SIZE words, no longer fits the request, so XMALLOC() returns NULL and image hashing fails with MEMORY_E (observed as "Failure -1: Hdr 1, Hash 0, Sig 0" in the library smoke test).

Size sha_block by WC_SHA256_TSCRATCH_SIZE when the included wolfSSL defines it, falling back to the historical HASH_BLOCK_SIZE words for older wolfSSL and FIPS bundles that predate the constant; likewise gate the ED25519 pool's sha512_block on WC_SHA512_TSCRATCH_SIZE (the same size today, so this half is future-proofing, not a behavior change). SHA-384 and SHA3-384 slots keep the fallback sizing unchanged.

Merge before wolfSSL/wolfssl#11434

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #955

Scan targets checked: wolfboot-src, wolfboot-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[Copilot]

🟡 Changes recommended

The fallback array allocates only 64 bytes while advertising 128 bytes, allowing scratch writes and XFREE() scrubbing to overflow the buffer.

1 open issue

• Fix Ed25519 pool allocation size mismatch · New

What changed in this PR

Updates wolfBoot’s static hash allocation pools to accommodate wolfSSL’s larger SHA-256 transform scratch buffer, addressing image-hashing allocation failures.

Changes:

• Uses wolfSSL scratch-size constants when available, with fallbacks for older and FIPS bundles.
• Applies the sizing to SHA-256 slots across signature configurations and the Ed25519 SHA-512 slot.
• Preserves fallback sizing for SHA-384 and SHA3-384.

File	Description
src/​xmalloc.c	Updates hash-buffer dimensions and pool sizes to track wolfSSL transform scratch requirements.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #955

Scan targets checked: wolfboot-src, wolfboot-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[Copilot]

🟡 Changes recommended

ED25519 configurations using SHA-256 or SHA3-384 omit sha512.h, making WC_SHA512_TSCRATCH_SIZE unavailable and forcing the hard-coded fallback instead of the intended future-proof sizing.

1 open issue

• Include sha512.h for ED25519 scratch-size detection · New

1 resolved since last review

• Fix Ed25519 pool allocation size mismatch

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #955

Scan targets checked: wolfboot-src, wolfboot-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[Copilot]

🟢 Approval recommended

There are no active review issues for the static hash allocation pool sizing update.

No open issues 🎉

1 resolved since last review

• Include sha512.h for ED25519 scratch-size detection

_{Review effort: Balanced}