Fix low severity static analysis issues

Author: JeremiahM37

scripts/build_ffi.py

@@ -495,6 +495,7 @@ def build_ffi(local_wolfssl, features):
         int ML_KEM_ENABLED = """ + str(features["ML_KEM"]) + """;
         int ML_DSA_ENABLED = """ + str(features["ML_DSA"]) + """;
         int HKDF_ENABLED = """ + str(features["HKDF"]) + """;
+        int ERROR_STRINGS_ENABLED = """ + str(features["ERROR_STRINGS"]) + """;
     """
 
     ffibuilder.set_source( "wolfcrypt._ffi", init_source_string,
@@ -534,6 +535,7 @@ def build_ffi(local_wolfssl, features):
         extern int ML_KEM_ENABLED;
         extern int ML_DSA_ENABLED;
         extern int HKDF_ENABLED;
+        extern int ERROR_STRINGS_ENABLED;
 
         typedef unsigned char byte;
         typedef unsigned int word32;
@@ -559,6 +561,7 @@ def build_ffi(local_wolfssl, features):
         typedef struct { ...; } mp_int;
 
         int mp_init (mp_int * a);
+        void mp_clear (mp_int * a);
         int mp_to_unsigned_bin (mp_int * a, unsigned char *b);
         int mp_to_unsigned_bin_len (mp_int * a, unsigned char *b, int c);
         int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c);
@@ -570,6 +573,7 @@ def build_ffi(local_wolfssl, features):
         int wc_InitSha(wc_Sha*);
         int wc_ShaUpdate(wc_Sha*, const byte*, word32);
         int wc_ShaFinal(wc_Sha*, byte*);
+        void wc_ShaFree(wc_Sha*);
         """
 
     if features["SHA256"]:
@@ -578,6 +582,7 @@ def build_ffi(local_wolfssl, features):
         int wc_InitSha256(wc_Sha256*);
         int wc_Sha256Update(wc_Sha256*, const byte*, word32);
         int wc_Sha256Final(wc_Sha256*, byte*);
+        void wc_Sha256Free(wc_Sha256*);
         """
 
     if features["SHA384"]:
@@ -586,6 +591,7 @@ def build_ffi(local_wolfssl, features):
         int wc_InitSha384(wc_Sha384*);
         int wc_Sha384Update(wc_Sha384*, const byte*, word32);
         int wc_Sha384Final(wc_Sha384*, byte*);
+        void wc_Sha384Free(wc_Sha384*);
         """
 
     if features["SHA512"]:
@@ -595,6 +601,7 @@ def build_ffi(local_wolfssl, features):
         int wc_InitSha512(wc_Sha512*);
         int wc_Sha512Update(wc_Sha512*, const byte*, word32);
         int wc_Sha512Final(wc_Sha512*, byte*);
+        void wc_Sha512Free(wc_Sha512*);
         """
     if features["SHA3"]:
         cdef += """
@@ -611,6 +618,10 @@ def build_ffi(local_wolfssl, features):
         int wc_Sha3_256_Final(wc_Sha3*, byte*);
         int wc_Sha3_384_Final(wc_Sha3*, byte*);
         int wc_Sha3_512_Final(wc_Sha3*, byte*);
+        int wc_Sha3_224_Free(wc_Sha3*);
+        int wc_Sha3_256_Free(wc_Sha3*);
+        int wc_Sha3_384_Free(wc_Sha3*);
+        int wc_Sha3_512_Free(wc_Sha3*);
         """
 
     if features["DES3"]:
@@ -707,6 +718,7 @@ def build_ffi(local_wolfssl, features):
         int wc_HmacSetKey(Hmac*, int, const byte*, word32);
         int wc_HmacUpdate(Hmac*, const byte*, word32);
         int wc_HmacFinal(Hmac*, byte*);
+        void wc_HmacFree(Hmac*);
         """
 
     if features["RSA"]:
@@ -991,6 +1003,11 @@ def build_ffi(local_wolfssl, features):
         int wolfCrypt_GetPrivateKeyReadEnable_fips(enum wc_KeyType);
         """
 
+    if features["ERROR_STRINGS"]:
+        cdef += """
+        const char* wc_GetErrorString(int error);
+        """
+
     if features["ML_KEM"] or features["ML_DSA"]:
         cdef += """
         static const int INVALID_DEVID;

wolfcrypt/asn.py

@@ -20,6 +20,8 @@
 
 # pylint: disable=no-member,no-name-in-module
 
+import hmac as _hmac
+
 from wolfcrypt._ffi import ffi as _ffi
 from wolfcrypt._ffi import lib as _lib
 from wolfcrypt.exceptions import WolfCryptError
@@ -63,13 +65,13 @@ def der_to_pem(der, pem_type):
         return _ffi.buffer(pem, pem_length)[:]
 
     def hash_oid_from_class(hash_cls):
-        if hash_cls == Sha:
+        if _lib.SHA_ENABLED and hash_cls == Sha:
             return _lib.SHAh
-        elif hash_cls == Sha256:
+        elif _lib.SHA256_ENABLED and hash_cls == Sha256:
             return _lib.SHA256h
-        elif hash_cls == Sha384:
+        elif _lib.SHA384_ENABLED and hash_cls == Sha384:
             return _lib.SHA384h
-        elif hash_cls == Sha512:
+        elif _lib.SHA512_ENABLED and hash_cls == Sha512:
             return _lib.SHA512h
         else:
             err = "Unknown hash class {}.".format(hash_cls.__name__)
@@ -97,4 +99,4 @@ def make_signature(data, hash_cls, key=None):
     def check_signature(signature, data, hash_cls, pub_key):
         computed_signature = make_signature(data, hash_cls)
         decrypted_signature = pub_key.verify(signature)
-        return computed_signature == decrypted_signature
+        return _hmac.compare_digest(computed_signature, decrypted_signature)