Add negative-count and NULL checks to group-setting and shared-cipher APIs

[ColtonWilley]

• wolfSSL_CTX_set_groups / wolfSSL_set_groups: add count < 0 to
  entry guard — negative count passes the upper-bound check and truncates
  to a garbage numGroups byte, causing OOB read during SSL init
• wolfSSL_CTX_set1_groups / wolfSSL_set1_groups: widen count == 0
  to count <= 0 and add NULL groups check
• wolfSSL_get_shared_ciphers: add NULL checks for buf and
  wolfSSL_get_cipher_name_iana return value

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +236 B (+0.4%, 63,467 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m3

• FLASH: .text +328 B (+0.3%, 121,233 B / 262,144 B, total: 46% used)

gcc-arm-cortex-m4

• FLASH: .text +512 B (+0.3%, 198,702 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +256 B (+0.4%, 66,059 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +256 B (+0.1%, 173,550 B / 262,144 B, total: 66% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +256 B (+0.1%, 179,544 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +256 B (+0.4%, 61,037 B / 262,144 B, total: 23% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +512 B (+0.1%, 766,188 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +256 B (+0.1%, 210,929 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +256 B (+0.1%, 277,144 B / 1,048,576 B, total: 26% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +512 B (+0.2%, 322,616 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +256 B (+0.4%, 61,037 B / 262,144 B, total: 23% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +320 B (+0.3%, 121,997 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +256 B (+0.1%, 234,400 B / 262,144 B, total: 89% used)

gcc-arm-cortex-m7

• FLASH: .text +512 B (+0.3%, 198,702 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +256 B (+0.1%, 277,720 B / 1,048,576 B, total: 26% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +256 B (+0.1%, 234,464 B / 262,144 B, total: 89% used)

linuxkm-pie

• Data: __patchable_function_entries +32 B (+0.1%, 24,208 B)

linuxkm-standard

• Data: __patchable_function_entries +48 B (+0.1%, 45,920 B)
  No memory changes detected for:
• stm32-sim-stm32h753

[github-actions]

retest this please

[Copilot]

Pull request overview

This PR hardens several public-facing TLS APIs against invalid inputs (negative group counts and NULL pointers) to prevent misbehavior such as out-of-bounds reads, and adds regression tests to lock in the corrected behavior.

Changes:

• Add input validation for negative counts / NULL pointers in group-setting and shared-cipher APIs.
• Add TLS 1.3 API tests for negative group counts and NULL group lists.
• Add an API test covering wolfSSL_get_shared_ciphers() NULL/zero-length handling.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/api/test_tls13.c	Adds TLS 1.3 regression coverage for negative group counts and NULL group pointer cases.
tests/api/test_tls.h	Registers the new shared-ciphers API test in the TLS test list.
tests/api/test_tls.c	Implements test_wolfSSL_get_shared_ciphers() to validate NULL/zero-length handling and behavior with/without error strings.
src/ssl.c	Adds NULL checks for wolfSSL_get_shared_ciphers() and strengthens argument validation for *_set1_groups() APIs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.