Fix DecodeAltNames length check

[embhorn]

Description

In DecodeAltNames(), the non-template ASN path (--enable-asn=original) needs a bounds check before length -= strLen.

Fixes zd21390

Testing

Added test_DecodeAltNames_length_underflow

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Fixes an integer underflow in DecodeAltNames() when parsing Subject Alternative Name (SAN) entries in the non-template ASN path, and adds a regression test to ensure malformed SAN lengths are rejected.

Changes:

• Added bounds checks before decrementing the remaining SEQUENCE length in DecodeAltNames().
• Added an API-level regression test covering SAN length underflow.
• Registered the new test in the ASN test suite declarations.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
wolfcrypt/src/asn.c	Adds bounds checks to prevent length underflow while decoding SAN entries.
tests/api/test_asn.h	Declares and registers the new regression test.
tests/api/test_asn.c	Adds a regression test certificate with malformed SAN length and a control certificate.

Comments suppressed due to low confidence (2)

wolfcrypt/src/asn.c:1

• The bounds check is performed after the entry has already been added to the certificate. On malformed input this can leave partially-populated alt-name state in cert (and potentially allocate/link nodes) even though the function returns an error. Consider moving the strLen > length check to occur before AddAltName() (and before linking nodes in the other SAN cases) so the decode remains side-effect-free on failure.
  wolfcrypt/src/asn.c:1
• The expression (word32)strLen + idx - lenStartIdx is evaluated in 32-bit arithmetic and can overflow/wrap before the comparison, potentially allowing the bounds check to be bypassed for large values. To keep the check correct, compute the consumed length using a wider type (e.g., word64/size_t) or do overflow-safe incremental checks before comparing/subtracting from length.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[embhorn]

Fix confirmed by reporter