Fenrir fixes

[rlm2002]

Fixes 14 Fenrir reports. Includes zeroing out buffers, correcting references, and adjusts when DhGenerateKeyPair exceptions are returned in JNI layer.

28-04-2026: Add on 5 more Fenrir reports. Zeros out buffers and adjusts output buffer offset positioning.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #212

Scan targets checked: wolfcrypt-jni-bugs, wolfcrypt-jni-src

No new issues found in the changed files. ✅

[Copilot]

Pull request overview

This PR addresses a set of Fenrir reports across the JCE provider and JNI layers, primarily by ensuring sensitive temporary buffers are wiped and by tightening JNI error/exception handling behavior (notably around DH keypair generation).

Changes:

• Zero out sensitive temporary key material in multiple JCE provider paths (KeyStore, Signature, Cipher, MAC, KeyFactories).
• Use wc_ForceZero (when available) before freeing native buffers in several JNI wrappers.
• Adjust JNI DH keypair generation flow to avoid additional JNI calls when an exception is already pending.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java	Zero PKCS#8 private key encoding buffer after cert/key match check.
src/main/java/com/wolfssl/provider/jce/WolfCryptSignature.java	Zero encoded private key bytes after initializing signing.
src/main/java/com/wolfssl/provider/jce/WolfCryptRSAKeyFactory.java	Zero encoded key buffers after building PKCS#8 specs / translating keys.
src/main/java/com/wolfssl/provider/jce/WolfCryptMac.java	Zero encoded secret key bytes after MAC initialization.
src/main/java/com/wolfssl/provider/jce/WolfCryptECKeyFactory.java	Zero encoded EC key buffers after creating PKCS#8 specs / translating keys.
src/main/java/com/wolfssl/provider/jce/WolfCryptDHKeyFactory.java	Zero encoded DH key buffers after creating PKCS#8 specs / translating keys.
src/main/java/com/wolfssl/provider/jce/WolfCryptCipher.java	Zero encoded key material after key setup, key size query, and wrapping.
jni/jni_rsa.c	Force-zero temporary RSA buffers before free when supported.
jni/jni_pwdbased.c	Force-zero derived-key buffers before free; correct unused-variable reference.
jni/jni_ecc.c	Force-zero temporary ECC buffers before free; fix UTF string release on error.
jni/jni_dh.c	Adjust exception flow in DH key generation; force-zero DH buffers before free.
jni/jni_asn.c	Force-zero PKCS#8 copy buffer before free when supported.
jni/jni_aesgcm.c	Force-zero decrypt output buffer before free when supported.
jni/jni_aesccm.c	Force-zero decrypt output buffer before free when supported.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.