Fenrir fixes

[julek-wolfssl]

No description provided.

[Copilot]

Pull request overview

Adds defensive argument validation and strengthens cleanup/zeroization of sensitive buffers across cryptography and TLS 1.3 code paths.

Changes:

• Add NULL argument checks in DES CBC encrypt/decrypt and crypt key derivation helpers.
• Harden HPKE context open API by validating more input pointers.
• Improve TLS 1.3 secret-handling by consolidating error paths and zeroizing intermediate buffers (binder keys, MACs, HMAC temp).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
wolfcrypt/src/wc_encrypt.c	Adds early BAD_FUNC_ARG returns for NULL pointers in DES CBC and CryptKey helpers.
wolfcrypt/src/hpke.c	Extends argument validation in wc_HpkeContextOpenBase.
src/tls13.c	Refactors multiple early returns to cleanup: for consistent ForceZero() of sensitive buffers.
src/internal.c	Simplifies preprocessor guards around “encrypted data too long” logic and restructures TLS1.3 vs non-TLS1.3 branches.

Comments suppressed due to low confidence (1)

src/internal.c:1

• This change removes the previous compilation guards around the tooLong/record_overflow check (previously only compiled when WOLFSSL_TLS13 or WOLFSSL_EXTRA_ALERTS was enabled). As written, the non-TLS1.3 MAX_TLS_CIPHER_SZ check will now compile and run even when WOLFSSL_EXTRA_ALERTS is not defined, which is a functional change and can also break builds if MAX_TLS_CIPHER_SZ (or related alert behavior) is not available under those configurations. Consider restoring an equivalent #if defined(WOLFSSL_TLS13) || defined(WOLFSSL_EXTRA_ALERTS) guard around the tooLong logic (or otherwise ensuring the macro/behavior is valid in all builds) to avoid changing behavior across feature-flag combinations.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[julek-wolfssl]

Retest this please Error cloning