[ohki-saito]

Description

Fenrir Finding F-7523

wolfSSL_OCSP_request_add0_id() freed the previous req->cid, stored the new cid in req, and overwrote issuerHash/issuerKeyHash/hashAlg before allocating the serial buffer. If that allocation failed, the function returned NULL with req partly updated and already holding cid. A caller following add0 semantics frees cid after a failed call, so wolfSSL_OCSP_REQUEST_free() later freed it again.

Changes:

• Allocate the serial buffer before changing req. On failure, req is unchanged and the caller still owns cid.
• Free req->serial with DYNAMIC_TYPE_OCSP_REQUEST, matching how it is allocated.

Testing

Added a test using a custom allocator that fails the serial allocation in OCSP_request_add0_id(). It checks that the call returns NULL, that req has no cid and no serial afterwards, and that freeing cid and req separately does not double free.

Checklist

• added tests
• updated/added doxygen
• updated

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Copilot]

🟡 Changes recommended

The OCSP regression test references allocator callbacks and failure flags outside their configuration guards, causing compilation failures when WOLFSSL_STATIC_MEMORY or WOLFSSL_NO_MALLOC is defined, or USE_WOLFSSL_MEMORY is absent.

1 open issue

• Guard OCSP allocator regression code with matching configuration checks · New

What changed in this PR

Addresses F-7523 in wolfSSL’s OCSP compatibility API by preserving request state and caller ownership when serial-buffer allocation fails, preventing a double free.

Changes:

• Allocates the replacement serial buffer before modifying the request.
• Uses the matching allocation type when freeing the old serial buffer.
• Adds an allocation-failure regression test for ownership and cleanup.

File	Description
tests/​api.c	Adds allocator fault injection and checks failed-call state and cleanup.
src/​ocsp.c	Makes serial allocation failure leave the request unchanged and corrects the free allocation type.

_{Review effort: Balanced}