[yosuke-wolfssl]

Problem

All 72 encoder dispatch tables registered the key-management import as
OSSL_FUNC_ENCODER_IMPORT_OBJECT. OpenSSL passes the encoder context, not a key,
so the import writes past the context, and its int 1/0 return is used as the
key pointer and later freed. OpenSSL calls this slot only for a key whose
provider has no encoders, such as OpenSSL's FIPS provider.

Fix (src/wp_*_kmgmt.c)

A correctly typed wp_<alg>_import_object() for RSA, EC, ECX, DH and ML-DSA
allocates a key from the encoder context, imports into it, and returns it, or
NULL on failure. Closes f_11552.

Tests

test_encoder_import_object() calls IMPORT_OBJECT with OpenSSL's real inputs
(EVP_PKEY_todata() output, EVP_PKEY_PUBLIC_KEY or EVP_PKEY_KEYPAIR) and
checks every key value comes back. test_encoder_import_object_rejected()
expects NULL for keys wolfProvider cannot hold: a 16384-bit RSA modulus, EC
sect233k1, DH modp_1536, an invalid ED25519 point.

Verification

• Unit suite: 247 passed, 0 failed on 14 OpenSSL releases (3.0.6 through 3.6.5);
  ML-DSA tests pass on OpenSSL 3.6.5.
• Through OpenSSL's encoder, with keys from a provider that has key management
  but no encoders (the FIPS provider's shape): RSA, EC, X25519, ED25519, X448,
  ED448 and DH encode as SubjectPublicKeyInfo and PrivateKeyInfo, byte-identical
  to OpenSSL's own encoding. Without the fix every case fails and ECX crashes.
• With the fix reverted, all four import-object tests crash or fail.

[Copilot]

Pull request overview

Fixes wolfProvider encoder dispatch tables to implement OSSL_FUNC_ENCODER_IMPORT_OBJECT with the correct “import-object” semantics (receive encoder ctx, allocate and return a new provider key object), preventing memory corruption and invalid frees when encoding keys owned by a different provider in multi-provider OSSL_LIB_CTX scenarios.

Changes:

• Add per-algorithm *_import_object() wrappers that allocate a new key object and import parameters into it, and register them in encoder dispatch tables.
• Refactor ECX key allocation into wp_ecx_new_by_type() so decode and import-object share the same key-type selection logic.
• Add unit tests that directly drive NEWCTX + IMPORT_OBJECT + FREE_OBJECT + FREECTX and validate imported key material via keymgmt export.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/unit.h	Declares new import-object contract test helpers and per-alg test entrypoints.
test/unit.c	Registers new import-object tests in the unit test table.
test/test_pkey.c	Implements generic provider dispatch-table probing + import-object contract test harness.
test/test_rsa.c	Adds RSA/RSA-PSS coverage for encoder import-object behavior.
test/test_ecc.c	Adds EC encoder import-object test (P-256 public+params).
test/test_ecx.c	Adds ECX import-object coverage across X25519/ED25519/X448/ED448 variants.
test/test_dh.c	Adds DH import-object test using named group parameters.
test/test_mldsa.c	Adds ML-DSA-44 import-object test coverage.
src/wp_rsa_kmgmt.c	Adds wp_rsa_import_object() and wires it into all RSA encoder dispatch tables.
src/wp_ecc_kmgmt.c	Adds wp_ecc_import_object() and wires it into ECC encoder dispatch tables.
src/wp_ecx_kmgmt.c	Adds wp_ecx_new_by_type() + wp_ecx_import_object() and updates ECX encoder dispatch tables.
src/wp_dh_kmgmt.c	Adds wp_dh_import_object() and wires it into DH encoder dispatch tables.
src/wp_mldsa_kmgmt.c	Adds wp_mldsa_import_object() and wires it into ML-DSA encoder dispatch tables (macro-generated).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #475

Scan targets checked: wolfprovider-bugs
Failed targets: wolfprovider-src

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #475

Scan targets checked: wolfprovider-bugs, wolfprovider-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #475

Scan targets checked: wolfprovider-bugs, wolfprovider-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.