Reject out-of-range SHE counter, flags and key IDs

[yosuke-wolfssl]

Problem

The SHE key-update builders expose packed protocol fields as full-width C
integers and validate only pointers and buffer lengths, never value ranges.
Out-of-range values were silently truncated or bled into the adjacent field,
and the call still returned 0:

Parameter	C type	Field width	Effect when exceeded
counter	word32	28 bits	wraps to a smaller value
flags	byte	4 bits	overwrites the counter's low nibble
authKeyId	byte	4 bits	bleeds into the target-key-ID nibble
targetKeyId	byte	4 bits	truncated

The counter is SHE's anti-rollback field, and wc_SHE_GetCounter() hands the
caller a word32 that is fed straight back in, so the wrap is reachable on a
normal round trip. A key ID above 0x0F is worse: the generated M1 or M4 names
a different HSM key slot than the caller asked for, with no error returned.
Medium severity.

Fix (wolfcrypt/src/wc_she.c)

wc_SHE_GenerateM1M2M3() and wc_SHE_GenerateM4M5() now reject these with
BAD_FUNC_ARG:

    /* Reject values wider than their packed field */
    if (counter > WC_SHE_COUNTER_MAX || flags > WC_SHE_FLAGS_MAX ||
        authKeyId > WC_SHE_KEY_ID_MAX || targetKeyId > WC_SHE_KEY_ID_MAX) {
        return BAD_FUNC_ARG;
    }

• Placement is at function entry, ahead of the crypto-callback dispatch,
  unlike the existing pointer/size checks. The widths come from the SHE
  protocol, so an HSM backend handed a 2^28 counter would build an equally
  wrong message. There is no "the secure element supplies it instead" case for
  a value range the way there is for authKey/newKey being NULL.
• Rejecting, not masking. Masking would still change the caller's intent
  without saying so.
• WC_SHE_COUNTER_MAX, WC_SHE_FLAGS_MAX, WC_SHE_KEY_ID_MAX added to
  wc_she.h beside the existing shift constants.
• Checks the encodable 4-bit width, not the narrower slot policy the header
  prose mentions (auth 0-14, target 1-14), since slot numbering is
  HSM-specific.

In-tree callers are unaffected: wc_SHE_LoadKey_Internal() passes zeros and
the KATs pass small values.

Closes f-7077.

Tests (tests/api/test_she.c)

Seven negative cases in test_wc_SHE_DecisionCoverage(), one out-of-range
operand per call, plus a boundary-accept case in
test_wc_SHE_GenerateM1M2M3() proving the largest encodable values still
succeed and the comparison is > and not >=.

Verification

• Negative control: before the fix, test_wc_SHE_DecisionCoverage failed with
  result: 0 != -173. After, the she group is 14/14 passed, 0 failed.
• Full ./tests/unit.test and ./wolfcrypt/test/testwolfcrypt pass.
• Builds clean with no new warnings under both --enable-she=standard (no
  WOLF_CRYPTO_CB) and --enable-she=extended --enable-cryptocb.

[Copilot]

Pull request overview

This PR hardens the SHE key-update message builders by rejecting out-of-range values for packed protocol fields, preventing silent truncation/bit-bleed that could change the effective counter, flags, or key IDs without error.

Changes:

• Add explicit max-value constants for packed SHE fields (counter, flags, key IDs) in the public SHE header.
• Validate counter, flags, authKeyId, and targetKeyId at entry in wc_SHE_GenerateM1M2M3() / wc_SHE_GenerateM4M5() and return BAD_FUNC_ARG on overflow.
• Extend API tests with boundary-accept and negative out-of-range cases to cover the new checks.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
wolfssl/wolfcrypt/wc_she.h	Adds max constants for packed-field widths used by SHE message generation.
wolfcrypt/src/wc_she.c	Enforces value-range validation before callback/software paths to prevent packed-field corruption.
tests/api/test_she.c	Adds boundary and negative tests validating the new range checks.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11155

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 4
3 finding(s) posted as inline comments (see file-level comments below)

Info (1)

Header parameter docs not updated for the new range rejection

File: wolfssl/wolfcrypt/wc_she.h:253
Function: wc_SHE_GenerateM1M2M3
Category: API contract violations

The parameter prose still states authKeyId is 0-14 and targetKeyId is 1-14 and does not mention that out-of-range counter/flags/key IDs now return BAD_FUNC_ARG. The enforced bound is WC_SHE_KEY_ID_MAX (15), so the documented range and the enforced range disagree in both directions.

Recommendation: Note the BAD_FUNC_ARG rejection and the enforced 4-bit/28-bit limits in the parameter comments for both builders.

---

This review was generated automatically by Fenrir. Findings are non-blocking.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753