[JacobBarthelmeh]

F-12379 and F-16275

[Copilot]

🟢 Approval recommended

There are no active review issues for the PKCS#7 input-validation changes and regression coverage.

No open issues 🎉

What changed in this PR

Tightens wolfCrypt’s PKCS#7 input validation and adds regression coverage for malformed signed and enveloped data.

Changes:

• Returns ASN_PARSE_E when the initial SignedData sequence cannot be parsed.
• Rejects empty KTRI encrypted keys before allocation and decryption.
• Adds tests for malformed inputs and repeated verification failures.

File	Description
wolfcrypt/​src/​pkcs7.c	Adds explicit parse errors for invalid SignedData sequences and empty encrypted keys.
tests/​api/​test_pkcs7.h	Declares and registers the two new regression tests.
tests/​api/​test_pkcs7.c	Tests malformed KTRI input and rejection of non-sequence SignedData input.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 223,188 B / 262,144 B, total: 85% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +20 B, text +10,016 B (+3.6%, 292,508 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}