Repository navigation
20261110-misc-fixes - #12084
Merged
Merged
20261110-misc-fixes#12084
Conversation
tests/api/test_ssl_ext.c, .github/configs/os-check-linux.json: fix -Wnull-dereferences in test_ech_decision_coverage(), masked in CI by dependence on WOLFSSL_TEST_STATIC_BUILD. * Make SetEchConfigsEx(), GetEchConfig(), GetEchConfigsEx(), FreeEchConfigs(), and SetRetryConfigs(), callable from test coding using WOLFSSL_TEST_VIS and wolfSSL_local_ symbol prefixes, so that test_ech_decision_coverage() doesn't depend on defined(WOLFSSL_TEST_STATIC_BUILD). * Also add statically-linked enable-all scenario in .github/configs/os-check-linux.json, to cover remaining tests that depend on defined(WOLFSSL_TEST_STATIC_BUILD).
…d clang-19-unreachable-all-crypto (-Wunreachable-code-aggressive coverage).
WOLFSSL_NAMED_GROUP_IS_PQC() and WOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(), to fix clang-diagnostic-unreachable-code-return in TLSX_DefaultGroupAllowed() (same syndrome addressed by 5b73ce9 in wolfSSL#12072).
…Info() in wolfSSL_ResourceFree(). also add .github/workflows/sanitizer-check.yml, which should catch defects in this class.
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the ECH testing, resource cleanup, and CI coverage changes.
No open issues 🎉
What changed in this PR
This PR fixes test accessibility and resource cleanup in wolfSSL, while expanding CI coverage for static builds, compiler warnings, and sanitizer checks.
Changes:
- Exposes ECH helpers to shared-library tests and guards against null dereferences in the ECH coverage test.
- Frees timeout packet buffers during session cleanup and simplifies disabled-PQC macros to avoid Clang warning false positives.
- Adds static-build, aggressive Clang warning, and sanitizer CI scenarios.
| File | Description |
|---|---|
wolfssl/internal.h |
Updates ECH helper visibility and simplifies disabled-PQC macros. |
tests/api/test_ssl_ext.c |
Enables ECH coverage beyond static builds and guards null session access. |
src/tls.c |
Updates calls to renamed ECH helpers. |
src/ssl_ech.c |
Renames ECH helper definitions and call sites for test access. |
src/internal.c |
Frees timeout buffers and updates ECH cleanup helper names. |
.wolfssl_known_macro_extras |
Removes the redundant WOLFSSL_CALLBACKS entry. |
.github/workflows/sanitizer-check.yml |
Adds sanitizer checks with and without callback support. |
.github/workflows/multi-compiler.yml |
Adds Clang 19 aggressive unreachable-code warning scenarios. |
.github/configs/os-check-linux.json |
Adds an all-features static-only test scenario. |
Review effort: Balanced
|
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #12084
Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json, .github/workflows/multi-compiler.yml, .github/workflows/sanitizer-check.yml, .wolfssl_known_macro_extras
Coverage: 5 of 5 in-scope changed file(s) opened by the reviewer
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Max
all-callbacks-sanitizer leg: WOLFSSL_QUIC is declared incompatible with WOLFSSL_CALLBACKS (settings.h #error), and --enable-all enables QUIC, failing early in configure's header-consistency check.
Contributor
Author
|
tested with |
Contributor
Author
|
retest this please |
philljj
approved these changes
Nov 11, 2026
philljj
left a comment
philljj
left a comment
Contributor
There was a problem hiding this comment.
thank you douzzer for the added sanitizer-check!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
src/ssl_ech.c,wolfssl/internal.h,src/internal.c,src/tls.c,tests/api/test_ssl_ext.c, .github/configs/os-check-linux.json:fix
-Wnull-dereferencesintest_ech_decision_coverage(), masked in CI bydependence on
WOLFSSL_TEST_STATIC_BUILD.Make
SetEchConfigsEx(),GetEchConfig(),GetEchConfigsEx(),FreeEchConfigs(),and
SetRetryConfigs(), callable from test coding usingWOLFSSL_TEST_VISandwolfSSL_local_symbol prefixes, so thattest_ech_decision_coverage()doesn'tdepend on
defined(WOLFSSL_TEST_STATIC_BUILD).Also add statically-linked enable-all scenario in
.github/configs/os-check-linux.json, to cover remaining tests that depend ondefined(WOLFSSL_TEST_STATIC_BUILD)..github/workflows/multi-compiler.yml: addclang-19-unreachable-allandclang-19-unreachable-all-crypto(-Wunreachable-code-aggressivecoverage).wolfssl/internal.h: use bare 0 in !WOLFSSL_HAVE_MLKEMdefinitions forWOLFSSL_NAMED_GROUP_IS_PQC()andWOLFSSL_NAMED_GROUP_IS_PQC_HYBRID(), to fixclang-diagnostic-unreachable-code-return in
TLSX_DefaultGroupAllowed()(samesyndrome addressed by 5b73ce9 in #12072).
src/internal.c: fix leaks fromAddPacketInfo()by callingFreeTimeoutInfo()inwolfSSL_ResourceFree().also add
.github/workflows/sanitizer-check.yml, which should catch defects in this class..wolfssl_known_macro_extras: GC