Fix the cppcheck findings

Four sites re-tested an unchanged ret after a WOLFSSH_SMALL_STACK
allocation, which cppcheck reports as identicalInnerCondition because the
allocation that can change ret is compiled out in the default build. Test
the allocated pointer instead; that is what the check is guarding.

- certman.c, keygen.c and wolfsshd/auth.c: check the DecodedCert, MlDsaKey
  and DecodedCert pointers.
- internal.c CompositeEccSign: give the fixed-buffer build pointer aliases
  so both builds have the same shape, then check the r/s pointers.
- port.c: initialize fileHandle, which is only assigned when mbstowcs_s
  succeeds.
- wolfsftp.c: zero localTime before WLOCALTIME, which is a per-port macro.

Author: ejohnstown

apps/wolfsshd/auth.c

@@ -2695,8 +2695,8 @@ static int RequestAuthentication(WS_UserAuthData* authData,
             DecodedCert* dCert = &sdCert;
         #endif
 
-            /* ret is still success unless the allocation above failed */
-            if (ret == WOLFSSH_USERAUTH_SUCCESS) {
+            /* NULL only when the small-stack allocation above failed */
+            if (dCert != NULL) {
                 wc_InitDecodedCert(dCert, authData->sf.publicKey.publicKey,
                         authData->sf.publicKey.publicKeySz, NULL);
                 if (wc_ParseCert(dCert, CERT_TYPE, NO_VERIFY, NULL) != 0) {

src/certman.c

@@ -404,7 +404,8 @@ int wolfSSH_CERTMAN_VerifyCerts_buffer(WOLFSSH_CERTMAN* cm,
         }
 #endif
 
-        if (ret == WS_SUCCESS) {
+        /* NULL only when the small-stack allocation above failed */
+        if (decoded != NULL) {
             wc_InitDecodedCert(decoded, certLoc[0], certLen[0], cm->heap);
             if (wc_ParseCert(decoded, WOLFSSL_FILETYPE_ASN1, NO_VERIFY, cm->cm)
                     != 0) {

src/internal.c

@@ -21926,11 +21926,14 @@ static int CompositeEccSign(void* key, WC_RNG* rng, void* heap,
                 ret = WS_MEMORY_E;
         }
 #else
-        byte rBuf[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
-        byte sBuf[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
+        byte rStore[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
+        byte sStore[MAX_ECC_BYTES + ECC_MAX_PAD_SZ];
+        byte* rBuf = rStore;
+        byte* sBuf = sStore;
 #endif
 
-        if (ret == 0) {
+        /* NULL only when a small-stack allocation above failed */
+        if (rBuf != NULL && sBuf != NULL) {
             ret = wc_ecc_sig_to_rs(asnSig, asnSigSz, rBuf, &rSz, sBuf, &sSz);
         }
         if (ret == 0) {

src/keygen.c

@@ -312,7 +312,8 @@ int wolfSSH_MakeMlDsaKey(byte* out, word32 outSz, word32 level)
         }
 #endif
 
-        if (ret == WS_SUCCESS) {
+        /* NULL only when the small-stack allocation above failed */
+        if (key != NULL) {
             if (wc_MlDsaKey_Init(key, NULL, INVALID_DEVID) != 0)
                 ret = WS_CRYPTO_FAILED;
             else {

src/port.c

@@ -250,7 +250,7 @@ void* WS_CreateFileA(const char* fileName, unsigned long desiredAccess,
         unsigned long shareMode, unsigned long creationDisposition,
         unsigned long flags, void* heap)
 {
-    HANDLE fileHandle;
+    HANDLE fileHandle = INVALID_HANDLE_VALUE;
     wchar_t* unicodeFileName;
     size_t unicodeFileNameSz = 0;
     size_t returnSz = 0;

src/wolfsftp.c

@@ -3151,6 +3151,9 @@ static int SFTP_CreateLongName(WS_SFTPNAME* name)
     mtime = (time_t)atr->mtime;
 
 #if defined(WLOCALTIME)
+    /* WLOCALTIME is a per-port macro; zero first so nothing reads a stale
+     * struct if a port leaves it untouched. */
+    WMEMSET(&localTime, 0, sizeof(localTime));
     if (!WLOCALTIME(&mtime, &localTime)) {
         return WS_MEMORY_E;
     }