Fix memory-safety, zeroization, and error-handling findings

[ejohnstown]

• F-7204 - echoserver's LoadPubKeyList() now checks the wolfSSH_ReadKey_buffer(), wc_CertPemToDer(), and WMALLOC() results so a malformed or missing key file skips the entry instead of handing PwMapNew() a NULL buffer and an indeterminate length.
• F-7205 - DoSshPubKey() wrote its null terminator at c[inSz-1], clobbering the last byte of the copied key; it now writes at c[inSz].
• F-7206 - _CertMan_init() never stored heap on the struct, so every WMALLOC/WFREE in certman.c ran with a NULL heap; it is now set during init.
• F-7207 - portfwd_worker() dropped the unsent tail after a short wolfSSH_ChannelSend(), and mistook a full buffer's zero-length recv() for the peer closing; both are fixed.
• F-7208 - CheckProfile() ignored the wc_GetDateAsCalendarTime() return and compared an indeterminate struct tm; it now zero-initializes, checks the return, and fails the profile on a parse error.
• F-7209 - DoPemKey() hardcoded isPrivate = 1 when identifying the decoded key; it now passes the caller's flag through.
• F-7210, F-7211 - the example client tracks public-key allocations with a userPublicKeyAlloc flag rather than pubKeyName (which leaked the cert buffer for -J without -j), and frees the CA cert and the TPM public key from the heap they were allocated from.
• F-7212 - wolfSSH_MakeRsaKey(), MakeEcdsaKey(), and MakeEd25519Key() freed their key structs unconditionally, so a failed init freed an indeterminate stack struct; frees are now gated on an init flag.
• F-7213 - GetConfigInt() ran WSTRCMP() on the caller's non-terminated slice, rejecting valid zero values like LoginGraceTime 0m; it now compares the NUL-terminated copy that atol() was given.
• F-7214 - wolfSSH_AGENT_worker() dereferenced ssh->agent without a null check; it now returns WS_AGENT_NULL_E.
• F-7215 - wolfSSH_SFTP_DoName() left ret holding the read length, so a NAME response with zero entries took the error path; ret is cleared before the loop.
• F-7216 - AeadIncrementExpIv() returned early on the first non-zero byte, making the nonce increment data-dependent; the carry now runs the full width with no early exit.
• F-7219 - SshResourceFree() wiped only kSz bytes of ssh->k, which can under-cover after a rekey; it now zeroes sizeof(ssh->k) and resets kSz.
• F-7220 - CheckPasswordHashUnix() left the hashed password in crypt()'s static buffer; it is wiped once the comparison is done.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1136

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

tests/api.c:1441

• wolfSSH_ReadKey_buffer() allocates SSH-format key outputs with DYNTYPE_PRIVKEY (via DoSshPubKey), but this test frees them with DYNTYPE_FILE. With memory tracking enabled, freeing with the wrong dyn type can break accounting/debug checks.

    WFREE(keyRef, NULL, DYNTYPE_FILE);
    WFREE(keyTrim, NULL, DYNTYPE_FILE);

examples/portfwd/portfwd.c:714

• When appBufferUsed == appBufferSz, appFd remains in the read fdset, so select() will return immediately as long as the socket stays readable. Because the recv() is skipped in that state, the loop can busy-spin at 100% CPU while waiting for wolfSSH_ChannelSend() to drain the buffer. Consider clearing appFd from rxFds while the buffer is full and still running the flush logic on select() timeout.

            }
        /* Skip the read when the buffer is full, a zero length recv() returns
         * 0 and would be mistaken for the peer closing. The buffer drains at
         * the bottom of the loop. */
        if (appFdSet && appBufferUsed < appBufferSz &&

[philljj]

Looks good, just 1 question.

Also, copilot suppressed this comment, but I can't figure out if actually valid:

When appBufferUsed == appBufferSz, appFd remains in the read fdset, so select() will return immediately as long as the socket stays readable. Because the recv() is skipped in that state, the loop can busy-spin at 100% CPU while waiting for wolfSSH_ChannelSend() to drain the buffer. Consider clearing appFd from rxFds while the buffer is full and still running the flush logic on select() timeout.