Fix multiple reported issues

[kareem-wolfssl]

Description

Fixes zd#22133

Testing

Built in tests, provided reproducers

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR addresses multiple reported issues (zd#22133) by tightening memory-management around X509 decoding and improving safety in shared-context initialization and key allocation logic.

Changes:

• Prevent orphaned allocations when re-decoding certificates into existing WOLFSSL_X509 objects.
• Add CTX-level locking around lazy ctx->suites initialization to avoid races/leaks in multi-threaded wolfSSL_new() usage.
• Zero newly allocated key structures in AllocKey() to make partial-init failure paths safe to free.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/ssl.c	Frees existing X509 contents before reinitializing/decoding to avoid orphaned allocations.
src/internal.c	Guards lazy ctx->suites init with CTX mutex and zeroes AllocKey() allocations pre-init.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +48 B (+0.0%, 122,651 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 200,917 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 769,724 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 280,064 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 123,419 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 200,917 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 280,640 B / 1,048,576 B, total: 27% used)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 48,744 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• stm32-sim-stm32h753

[PhilipTaronQ]

Works for me.

[kareem-wolfssl]

Retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 3 total — 1 posted, 2 skipped

Posted findings

• [Medium] suites race fix not applied to the parallel lazy-alloc path in wolfSSL_set_SSL_CTX — src/internal.c:8274-8299

Skipped findings

• [Medium] No regression test added for the concurrent suites-init and peerCert re-decode fixes
• [Low] Redundant FreeX509/InitX509 in wolfSSL_get_peer_certificate now that DecodeToX509 frees internally

Review generated by Skoll via Claude/Codex

[PhilipTaronQ]

@qcwallace

[Frauschi]

Jenkins retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 6 total — 3 posted, 3 skipped

Posted findings

• [Medium] Lazy ctx->suites init in wolfSSL_set_SSL_CTX left unguarded, defeating the mutex added to InitSSL — src/ssl.c:8486-8491
• [Medium] CTX refcount leaked when suites allocation fails in wolfSSL_set_SSL_CTX — src/ssl.c:8475-8491
• [Low] Redundant FreeX509/InitX509 now duplicated inside DecodeToX509 — src/ssl_api_cert.c:2765-2766

Skipped findings

• [Medium] CTX reference leaked when AllocateCtxSuites fails after reorder
• [Medium] Lazy suites init in wolfSSL_set_SSL_CTX left unguarded while InitSSL now locks
• [Low] Suites-init race the PR fixes in InitSSL remains open in wolfSSL_set_SSL_CTX

Review generated by Skoll via Claude/Codex