From 5dbc6db295ba271400267625feb078fb95c00aa5 Mon Sep 17 00:00:00 2001
From: David Kubasek <dkubase@ra.rockwell.com>
Date: Wed, 3 Mar 2021 10:25:54 +0100
Subject: [PATCH 01/55] Fixed CID 576149

---
 src/ssl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/ssl.c b/src/ssl.c
index 14a160dc2..d7d99c484 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -49965,6 +49965,9 @@ WOLFSSL_BIGNUM* wolfSSL_BN_bin2bn(const unsigned char* str, int len,
             return NULL;
         }
     } else {
+	/* This may be overly defensive */
+	if (weOwn)
+            wolfSSL_BN_free(ret);
         return NULL;
     }
 

From 38cfe7173243d2ad0cd558f94a28ffdf947c910c Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 15:41:28 +0100
Subject: [PATCH 02/55] Fixed CID 576552.

---
 src/crl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/crl.c b/src/crl.c
index 1663b347a..750ac65fc 100644
--- a/src/crl.c
+++ b/src/crl.c
@@ -633,6 +633,7 @@ static CRL_Entry* DupCRL_list(CRL_Entry* crl, void* heap)
                 current = head;
                 head = head->next;
                 FreeCRL_Entry(current, heap);
+                XFREE(current, heap, DYNAMIC_TYPE_CRL_ENTRY);
             }
 
             return NULL;

From ef34e613e8e23f96957d5709a69efe6867b4245b Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 15:46:37 +0100
Subject: [PATCH 03/55] Fixed CID 582947.

---
 src/ocsp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ocsp.c b/src/ocsp.c
index 4862cf939..53f44bbbf 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -799,8 +799,8 @@ OcspResponse* wolfSSL_d2i_OCSP_RESPONSE(OcspResponse** response,
                                       DYNAMIC_TYPE_OCSP_STATUS);
     if (resp->single->status == NULL) {
         XFREE(resp->source, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(resp, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
         XFREE(resp->single, NULL, DYNAMIC_TYPE_OCSP_ENTRY);
+        XFREE(resp, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
         return NULL;
     }
     XMEMSET(resp->single->status, 0, sizeof(CertStatus));

From 26578be1a792a600091d936139252767d2c25e8a Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 15:51:22 +0100
Subject: [PATCH 04/55] Fixed CID 583215.

---
 src/ocsp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ocsp.c b/src/ocsp.c
index 53f44bbbf..1b7395895 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -621,6 +621,7 @@ WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_cert_to_id(
         if (certStatus)
             XFREE(certStatus, NULL, DYNAMIC_TYPE_OPENSSL);
 
+        wolfSSL_CertManagerFree(cm);
         return NULL;
     }
 

From 0bdb2bf40c07cbac8be2a9e20991bfca5f0d0108 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 15:55:02 +0100
Subject: [PATCH 05/55] Fixed CID 583972.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index d7d99c484..df1310cf5 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -23674,6 +23674,7 @@ int wolfSSL_X509_cmp(const WOLFSSL_X509 *a, const WOLFSSL_X509 *b)
 
         if (wolfSSL_BIO_set_fp(bio, fp, BIO_NOCLOSE) != WOLFSSL_SUCCESS) {
             WOLFSSL_MSG("wolfSSL_BIO_set_fp error");
+            wolfSSL_BIO_free(bio);
             return WOLFSSL_FAILURE;
         }
 

From 27c5714f117e422445161a792308ce48c7a0a805 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 15:58:55 +0100
Subject: [PATCH 06/55] Fixed CID 586826.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index df1310cf5..ba2886615 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -44536,6 +44536,7 @@ WOLFSSL_RSA* wolfSSL_d2i_RSAPrivateKey_bio(WOLFSSL_BIO *bio, WOLFSSL_RSA **out)
         const byte* bioMemPt = bioMem; /* leave bioMem pointer unaltered */
         if ((key = wolfSSL_d2i_RSAPrivateKey(NULL, &bioMemPt, bioMemSz)) == NULL) {
             XFREE((unsigned char*)bioMem, bio->heap, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE((unsigned char*)maxKeyBuf, bio->heap, DYNAMIC_TYPE_TMP_BUFFER);
             return NULL;
         }
 

From d5c3d9ca4fc4ac404197a72ce08518b1b7c78835 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 16:03:32 +0100
Subject: [PATCH 07/55] Fixed CID 587064.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index ba2886615..9a25b0bfa 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -9475,6 +9475,7 @@ void* wolfSSL_X509V3_EXT_d2i(WOLFSSL_X509_EXTENSION* ext)
                     WOLFSSL_MSG("ASN1_STRING_set() failed");
                     wolfSSL_ASN1_OBJECT_free(ad->method);
                     XFREE(aia, NULL, DYNAMIC_TYPE_X509_EXT);
+                    XFREE(ad->location, NULL, DYNAMIC_TYPE_OPENSSL);
                     XFREE(ad, NULL, DYNAMIC_TYPE_X509_EXT);
                     return NULL;
                 }

From 18163c9a2ab6b559f860e873f56790baaef33bcf Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 16:38:28 +0100
Subject: [PATCH 08/55] Fixed CID 587269.

---
 src/ssl.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/ssl.c b/src/ssl.c
index 9a25b0bfa..8d40bbf79 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -41501,7 +41501,7 @@ err:
      *
      * returns WOLFSSL_SUCCESS on success
      */
-    static int wolfSSL_X509_INFO_set(WOLFSSL_X509_INFO* info,
+    static int wolfSSL_X509_INFO_set(WOLFSSL_X509_INFO** info,
             WOLFSSL_X509* x509)
     {
         if (info == NULL || x509 == NULL) {
@@ -41509,7 +41509,7 @@ err:
         }
 
         /* check is fresh "info" passed in, if not free it */
-        if (info->x509 != NULL || info->x_pkey != NULL) {
+        if ((*info)->x509 != NULL || (*info)->x_pkey != NULL) {
             WOLFSSL_X509_INFO* tmp;
 
             tmp = wolfSSL_X509_INFO_new();
@@ -41517,11 +41517,11 @@ err:
                 WOLFSSL_MSG("Unable to create new structure");
                 return MEMORY_E;
             }
-            wolfSSL_X509_INFO_free(info);
-            info = tmp;
+            wolfSSL_X509_INFO_free(*info);
+            (*info) = tmp;
         }
 
-        info->x509 = x509;
+        (*info)->x509 = x509;
 
         //@TODO info->num
         //@TODO info->enc_cipher
@@ -41529,8 +41529,8 @@ err:
         //@TODO info->enc_data
         //@TODO info->crl
 
-        info->x_pkey = wolfSSL_X509_PKEY_new(x509->heap);
-        return wolfSSL_X509_PKEY_set(info->x_pkey, x509);
+        (*info)->x_pkey = wolfSSL_X509_PKEY_new(x509->heap);
+        return wolfSSL_X509_PKEY_set((*info)->x_pkey, x509);
     }
 
     /**
@@ -41725,7 +41725,7 @@ err:
                     return NULL;
                 }
                 if (x509) {
-                    ret = wolfSSL_X509_INFO_set(current, x509);
+                    ret = wolfSSL_X509_INFO_set(&current, x509);
                 }
                 else if (crl) {
                     current->crl = crl;

From 061120dda6e24a5a728f1d25cae6b68ca56474af Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Wed, 3 Mar 2021 17:18:24 +0100
Subject: [PATCH 09/55] Fixed CID 587340.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index 8d40bbf79..66a3de121 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -8171,6 +8171,7 @@ int wolfSSL_X509_get_ext_count(const WOLFSSL_X509* passedCert)
                     CA_TYPE,
             NO_VERIFY, NULL) < 0) {
         WOLFSSL_MSG("\tCertificate parsing failed");
+        FreeDecodedCert(&cert);
         return WOLFSSL_FAILURE;
     }
 

From 1aa718a438ac2ffb0a78168671bf9a0094688b17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 18:49:00 +0100
Subject: [PATCH 10/55] Fixed CID 143658, 463100, 529732.

---
 src/ssl.c | 45 +++++++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/src/ssl.c b/src/ssl.c
index 14a160dc2..9488205e6 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -29623,21 +29623,36 @@ int wolfSSL_ASN1_GENERALIZEDTIME_print(WOLFSSL_BIO* bio,
     }
     p = (const char *)(asnTime->data);
     /* GetTimeString not always available. */
-    wolfSSL_BIO_write(bio, MonthStr(p + 4), 3);
-    wolfSSL_BIO_write(bio, " ", 1);
+    if (wolfSSL_BIO_write(bio, MonthStr(p + 4), 3) <= 0)
+        return WOLFSSL_FAILURE;
+    if (wolfSSL_BIO_write(bio, " ", 1) <= 0)
+        return WOLFSSL_FAILURE;
+
     /* Day */
-    wolfSSL_BIO_write(bio, p + 6, 2);
-    wolfSSL_BIO_write(bio, " ", 1);
+    if (wolfSSL_BIO_write(bio, p + 6, 2) <= 0)
+        return WOLFSSL_FAILURE;
+    if (wolfSSL_BIO_write(bio, " ", 1) <= 0)
+        return WOLFSSL_FAILURE;
+
     /* Hour */
-    wolfSSL_BIO_write(bio, p + 8, 2);
-    wolfSSL_BIO_write(bio, ":", 1);
+    if (wolfSSL_BIO_write(bio, p + 8, 2) <= 0)
+        return WOLFSSL_FAILURE;
+    if (wolfSSL_BIO_write(bio, ":", 1) <= 0)
+        return WOLFSSL_FAILURE;
+
     /* Min */
-    wolfSSL_BIO_write(bio, p + 10, 2);
-    wolfSSL_BIO_write(bio, ":", 1);
+    if (wolfSSL_BIO_write(bio, p + 10, 2) <= 0)
+        return WOLFSSL_FAILURE;
+    if (wolfSSL_BIO_write(bio, ":", 1) <= 0)
+        return WOLFSSL_FAILURE;
+
     /* Secs */
-    wolfSSL_BIO_write(bio, p + 12, 2);
-    wolfSSL_BIO_write(bio, " ", 1);
-    wolfSSL_BIO_write(bio, p, 4);
+    if (wolfSSL_BIO_write(bio, p + 12, 2) <= 0)
+        return WOLFSSL_FAILURE;
+    if (wolfSSL_BIO_write(bio, " ", 1) <= 0)
+        return WOLFSSL_FAILURE;
+    if (wolfSSL_BIO_write(bio, p, 4) <= 0)
+        return WOLFSSL_FAILURE;
 
     return 0;
 }
@@ -38545,7 +38560,10 @@ int wolfSSL_RSA_print(WOLFSSL_BIO* bio, WOLFSSL_RSA* rsa, int offset)
                 WOLFSSL_MSG("Memory error");
                 return WOLFSSL_FAILURE;
             }
-            mp_to_unsigned_bin(rsaElem, rawKey);
+            if (mp_to_unsigned_bin(rsaElem, rawKey) < 0) {
+                XFREE(rawKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                return WOLFSSL_FAILURE;
+            }
             for (idx = 0; idx < (word32)rawLen; idx++) {
                 char val[5];
                 int  valSz = 5;
@@ -47533,8 +47551,7 @@ int wolfSSL_i2a_ASN1_INTEGER(BIO *bp, const WOLFSSL_ASN1_INTEGER *a)
 
     /* Zero length integer is the value zero. */
     if (len == 0) {
-        wolfSSL_BIO_write(bp, "00", 2);
-        return 2;
+        return wolfSSL_BIO_write(bp, "00", 2);
     }
 
     if (Base16_Encode(a->data + idx, len, buf, &bufLen) != 0 ||

From af42e2a7999845ad5d23a5b9537f26b6b2cc0d12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 19:21:51 +0100
Subject: [PATCH 11/55] Fixed CID 576329.

---
 src/ssl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index c78ab7c78..1f3353d67 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -50203,7 +50203,7 @@ int wolfSSL_BN_clear_bit(WOLFSSL_BIGNUM* bn, int n)
 
     if (bn == NULL || bn->internal == NULL) {
         WOLFSSL_MSG("bn NULL error");
-        goto cleanup;
+        goto end;
     }
     if (mp_is_bit_set((mp_int*)bn->internal, n)) {
 #ifdef WOLFSSL_SMALL_STACK
@@ -50230,6 +50230,7 @@ cleanup:
     if (tmp)
         XFREE(tmp, NULL, DYNAMIC_TYPE_BIGINT);
 #endif
+end:
     return ret;
 }
 

From 806313ff1a8427b21ef799600d93dc0f52cf9ff4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 19:43:19 +0100
Subject: [PATCH 12/55] Fixed CID 576473.

---
 src/ssl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 1f3353d67..213dde472 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -36547,11 +36547,12 @@ int wolfSSL_EC_POINT_get_affine_coordinates_GFp(const WOLFSSL_EC_GROUP *group,
             mp_clear(&modulus);
             return WOLFSSL_FAILURE;
         }
+
+        mp_clear(&modulus);
     }
 
     BN_copy(x, point->X);
     BN_copy(y, point->Y);
-    mp_clear(&modulus);
 
     return WOLFSSL_SUCCESS;
 }

From d941cb445645f973fab76c57ede4f8d4ab74bd2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 19:48:54 +0100
Subject: [PATCH 13/55] Fixed CID 587279.

---
 src/ssl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/ssl.c b/src/ssl.c
index 213dde472..f6644de99 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -9330,6 +9330,8 @@ void* wolfSSL_X509V3_EXT_d2i(WOLFSSL_X509_EXTENSION* ext)
                 WOLFSSL_MSG("Failed to malloc authority key id");
                 return NULL;
             }
+            
+            XMEMSET(akey, 0, sizeof(WOLFSSL_AUTHORITY_KEYID));
 
             akey->keyid = wolfSSL_ASN1_STRING_new();
             if (akey->keyid == NULL) {

From c27c78f9e4a165bc5f674bead7a2268563035c81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 20:12:59 +0100
Subject: [PATCH 14/55] Fixed CID 529748.

---
 src/ssl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/ssl.c b/src/ssl.c
index f6644de99..d54a771a1 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -41907,8 +41907,10 @@ err:
         ne->object = wolfSSL_OBJ_nid2obj_ex(nid, ne->object);
         ne->value = wolfSSL_ASN1_STRING_type_new(type);
         if (ne->value != NULL) {
-            wolfSSL_ASN1_STRING_set(ne->value, (const void*)data, dataSz);
-            ne->set = 1;
+            if (wolfSSL_ASN1_STRING_set(ne->value, (const void*)data, dataSz)
+                    == WOLFSSL_SUCCESS) {
+                ne->set = 1;
+            }
         }
 
         return ne;

From 05156083ece4ba994b5f42944c130da773d6ecd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 20:29:21 +0100
Subject: [PATCH 15/55] Fixed CID 529770.

---
 wolfcrypt/src/integer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wolfcrypt/src/integer.c b/wolfcrypt/src/integer.c
index 81987f96d..25d3fa4b9 100644
--- a/wolfcrypt/src/integer.c
+++ b/wolfcrypt/src/integer.c
@@ -2409,7 +2409,7 @@ int mp_exptmod_base_2(mp_int * X, mp_int * P, mp_int * Y)
   }
 
   /* swap res with Y */
-  mp_copy(res, Y);
+  err = mp_copy(res, Y);
 
 LBL_RES:mp_clear (res);
 LBL_M:

From 9ea66868d8d7cb326f13a9ba215bb605b5661bea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 20:37:29 +0100
Subject: [PATCH 16/55] Fixed CID 536133.

---
 wolfcrypt/src/integer.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/wolfcrypt/src/integer.c b/wolfcrypt/src/integer.c
index 25d3fa4b9..2f75291a6 100644
--- a/wolfcrypt/src/integer.c
+++ b/wolfcrypt/src/integer.c
@@ -868,16 +868,13 @@ int mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y)
      return MP_VAL;
   }
   if (mp_isone(P)) {
-     mp_set(Y, 0);
-     return MP_OKAY;
+     return mp_set(Y, 0);
   }
   if (mp_iszero(X)) {
-     mp_set(Y, 1);
-     return MP_OKAY;
+     return mp_set(Y, 1);
   }
   if (mp_iszero(G)) {
-     mp_set(Y, 0);
-     return MP_OKAY;
+     return mp_set(Y, 0);
   }
 
   /* if exponent X is negative we have to recurse */

From f2b832415e295464bd490bcd18e893483784606e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 20:57:40 +0100
Subject: [PATCH 17/55] Fixed CID 576799.

---
 wolfcrypt/src/pkcs12.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/pkcs12.c b/wolfcrypt/src/pkcs12.c
index 10bb8b3cc..eb38a2a3f 100644
--- a/wolfcrypt/src/pkcs12.c
+++ b/wolfcrypt/src/pkcs12.c
@@ -751,7 +751,14 @@ int wc_i2d_PKCS12(WC_PKCS12* pkcs12, byte** der, int* derSz)
             outerSz += mac->saltSz;
 
             /* MAC iterations */
-            outerSz += SetShortInt(ASNSHORT, &tmpIdx, mac->itt, MAX_SHORT_SZ);
+            ret = SetShortInt(ASNSHORT, &tmpIdx, mac->itt, MAX_SHORT_SZ);
+            if (ret >= 0) {
+                outerSz += ret;
+                ret = 0;
+            }
+            else {
+                return ret;
+            }
 
             /* sequence of inner data */
             outerSz += SetSequence(innerSz, seq);

From d3314f142a8dbe5f855a1054159926d1e5d992cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 21:04:51 +0100
Subject: [PATCH 18/55] Fixed CID 576946.

---
 wolfcrypt/src/asn.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index fe2799478..f3c282907 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -4173,7 +4173,13 @@ int EncryptContent(byte* input, word32 inputSz, byte* out, word32* outSz,
     seqSz += sz;
 
     tmpIdx = 0;
-    seqSz += SetShortInt(shr, &tmpIdx, itt, maxShr);
+    ret = SetShortInt(shr, &tmpIdx, itt, maxShr);
+    if (ret >= 0) {
+        seqSz += ret;
+    }
+    else {
+        return ret;
+    }
     innerSz += seqSz + SetSequence(seqSz, seq);
     totalSz += innerSz + SetSequence(innerSz, seq);
 

From c634c6c8503e1aeb440e35253693be499877cc18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 21:09:24 +0100
Subject: [PATCH 19/55] Fixed CID 577188.

---
 src/ssl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/ssl.c b/src/ssl.c
index d54a771a1..2d68a0d4f 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -41862,8 +41862,10 @@ err:
             ne->object = wolfSSL_OBJ_nid2obj_ex(nid, ne->object);
             ne->value = wolfSSL_ASN1_STRING_type_new(type);
             if (ne->value != NULL) {
-                wolfSSL_ASN1_STRING_set(ne->value, (const void*)data, dataSz);
-                ne->set = 1;
+                if (wolfSSL_ASN1_STRING_set(ne->value, (const void*)data,
+                                            dataSz) == WOLFSSL_SUCCESS) {
+                    ne->set = 1;
+                }
             }
         }
 

From 3770d4c5811b4dea356fe6dcf9694dadaa93c6f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 21:20:33 +0100
Subject: [PATCH 20/55] Fixed CID 577295.

---
 wolfcrypt/src/wc_port.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index cc7022e14..99b3a4782 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -386,7 +386,10 @@ int wc_FileLoad(const char* fname, unsigned char** buf, size_t* bufLen,
         return BAD_PATH_ERROR;
     }
 
-    XFSEEK(f, 0, XSEEK_END);
+    if (XFSEEK(f, 0, XSEEK_END) != 0) {
+        WOLFSSL_MSG("wc_LoadFile file seek error");
+        return BAD_PATH_ERROR;
+    }
     fileSz = XFTELL(f);
     XREWIND(f);
     if (fileSz > 0) {

From b383d9327418f8b65f8e178dd963190a35e0f190 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 3 Mar 2021 21:32:34 +0100
Subject: [PATCH 21/55] Fixed CID 582952.

---
 src/ocsp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/ocsp.c b/src/ocsp.c
index 1b7395895..efb86f37c 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -607,7 +607,9 @@ WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_cert_to_id(
         /* AddCA() frees the buffer. */
         XMEMCPY(derCert->buffer, issuer->derCert->buffer,
                 issuer->derCert->length);
-        AddCA(cm, &derCert, WOLFSSL_USER_CA, 1);
+        ret = AddCA(cm, &derCert, WOLFSSL_USER_CA, 1);
+        if (ret != WOLFSSL_SUCCESS)
+            return NULL;
     }
 
     certId = (WOLFSSL_OCSP_CERTID*)XMALLOC(sizeof(WOLFSSL_OCSP_CERTID), NULL,

From d5cd9c4a7fb90a1c5d0bb479bc665f3dafb5746e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Thu, 4 Mar 2021 01:02:11 +0100
Subject: [PATCH 22/55] Fixed CID 591810.

---
 wolfcrypt/src/wc_port.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 99b3a4782..87d4d09ec 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -388,6 +388,7 @@ int wc_FileLoad(const char* fname, unsigned char** buf, size_t* bufLen,
 
     if (XFSEEK(f, 0, XSEEK_END) != 0) {
         WOLFSSL_MSG("wc_LoadFile file seek error");
+        XFCLOSE(f);
         return BAD_PATH_ERROR;
     }
     fileSz = XFTELL(f);

From 86b5434dccca514cd4e7f91296b6bb080e7b6e70 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Thu, 4 Mar 2021 10:45:49 +0100
Subject: [PATCH 23/55] Fixed CID 587342.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index 2d68a0d4f..d5971c734 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -8531,6 +8531,7 @@ WOLFSSL_X509_EXTENSION* wolfSSL_X509_set_ext(WOLFSSL_X509* x509, int loc)
             NO_VERIFY, NULL) < 0) {
         WOLFSSL_MSG("\tCertificate parsing failed");
         wolfSSL_X509_EXTENSION_free(ext);
+        FreeDecodedCert(&cert);
         return NULL;
     }
 

From dbaf5456949c361833e41091cc564340206c80d2 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Thu, 4 Mar 2021 11:08:25 +0100
Subject: [PATCH 24/55] Fixed CID 587348 and CID 587349.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index d5971c734..af3cb613c 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -9552,6 +9552,7 @@ int wolfSSL_X509_get_ext_by_NID(const WOLFSSL_X509* x509, int nid, int lastPos)
             CA_TYPE,
             NO_VERIFY, NULL) < 0) {
         WOLFSSL_MSG("\tCertificate parsing failed");
+        FreeDecodedCert(&cert);
         return WOLFSSL_FATAL_ERROR;
     }
 

From f056601d2643b1e23b57c9423cfc43536d75209e Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Thu, 4 Mar 2021 11:16:40 +0100
Subject: [PATCH 25/55] Fixed CID 587549.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index af3cb613c..0593a3218 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -18298,6 +18298,7 @@ WOLF_STACK_OF(WOLFSSL_X509)* wolfSSL_set_peer_cert_chain(WOLFSSL* ssl)
         x509 = wolfSSL_X509_new();
         if (x509 == NULL) {
             WOLFSSL_MSG("Error Creating X509");
+            wolfSSL_sk_X509_free(sk);
             return NULL;
         }
         ret = DecodeToX509(x509, ssl->session.chain.certs[i].buffer,

From 027f05e34946602f6c07834701026f6f5632ed10 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Thu, 4 Mar 2021 13:40:45 +0100
Subject: [PATCH 26/55] Fixed CID 583215.

---
 src/ocsp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/ocsp.c b/src/ocsp.c
index efb86f37c..427c1a34c 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -608,8 +608,10 @@ WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_cert_to_id(
         XMEMCPY(derCert->buffer, issuer->derCert->buffer,
                 issuer->derCert->length);
         ret = AddCA(cm, &derCert, WOLFSSL_USER_CA, 1);
-        if (ret != WOLFSSL_SUCCESS)
+        if (ret != WOLFSSL_SUCCESS) {
+            wolfSSL_CertManagerFree(cm);
             return NULL;
+        }
     }
 
     certId = (WOLFSSL_OCSP_CERTID*)XMALLOC(sizeof(WOLFSSL_OCSP_CERTID), NULL,

From d510c270cd1606236b563701eb2c03ebb3c958f8 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 09:44:47 +0100
Subject: [PATCH 27/55] Fixed CID 212170.

---
 wolfcrypt/src/pkcs12.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/wolfcrypt/src/pkcs12.c b/wolfcrypt/src/pkcs12.c
index eb38a2a3f..8e61aa4cc 100644
--- a/wolfcrypt/src/pkcs12.c
+++ b/wolfcrypt/src/pkcs12.c
@@ -1820,6 +1820,7 @@ static int wc_PKCS12_encrypt_content(WC_PKCS12* pkcs12, WC_RNG* rng,
         idx += SetObjectId(sizeof(WC_PKCS12_DATA_OID), out + idx);
         if (idx + sizeof(WC_PKCS12_DATA_OID) > *outSz){
             WOLFSSL_MSG("Buffer not large enough for DATA OID");
+            XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
             return BUFFER_E;
         }
         XMEMCPY(out + idx, WC_PKCS12_DATA_OID, sizeof(WC_PKCS12_DATA_OID));
@@ -1827,6 +1828,7 @@ static int wc_PKCS12_encrypt_content(WC_PKCS12* pkcs12, WC_RNG* rng,
 
         /* copy over encrypted data */
         if (idx + encSz > *outSz){
+            XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
             return BUFFER_E;
         }
         XMEMCPY(out + idx, tmp, encSz);

From ad70112fd82f9e78ec50d8c218d832773471dc34 Mon Sep 17 00:00:00 2001
From: David Kubasek <dkubase@ra.rockwell.com>
Date: Fri, 5 Mar 2021 10:35:14 +0100
Subject: [PATCH 28/55] Fixed CID 576268

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 0593a3218..95fc7e37b 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -48284,7 +48284,7 @@ int wolfSSL_CTX_set1_curves_list(WOLFSSL_CTX* ctx, const char* names)
         #endif
         }
 
-        if (curve > (sizeof(word32) * WOLFSSL_BIT_SIZE)) {
+        if (curve >= (sizeof(word32) * WOLFSSL_BIT_SIZE)) {
             /* shift left more than size of ctx->disabledCurves causes static
              * analysis report */
             WOLFSSL_MSG("curve value is too large for upcoming shift");

From d2b26f66d543a34334cc75350b38592d8a4ebbec Mon Sep 17 00:00:00 2001
From: David Kubasek <dkubase@ra.rockwell.com>
Date: Fri, 5 Mar 2021 10:59:08 +0100
Subject: [PATCH 29/55] Fixed CID 578018

---
 src/ssl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/ssl.c b/src/ssl.c
index 95fc7e37b..36acaaac2 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -40280,6 +40280,10 @@ void* wolfSSL_GetDhAgreeCtx(WOLFSSL* ssl)
                 WOLFSSL_MSG("Serial size error");
                 return WOLFSSL_FAILURE;
             }
+            if (sizeof(cert->serial) < serialSz) {
+                WOLFSSL_MSG("Serial buffer too small");
+                return BUFFER_E;
+            }
             XMEMCPY(cert->serial, serial, serialSz);
             cert->serialSz = serialSz;
         #else

From 0caed02db765a0d3e30dc4c6a2274835971f5d4b Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 12:04:30 +0100
Subject: [PATCH 30/55] Fixed CID 576609.

---
 src/ssl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 36acaaac2..dc97170c1 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -16113,7 +16113,8 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
         }
 
         if (len < 0) {
-            len = (int)XSTRLEN((const char*)buf);
+            /* The length of the string including terminating null. */
+            len = (int)XSTRLEN((const char*)buf) + 1;
         }
         bio->num = bio->wrSz = len;
         bio->ptr = (byte*)XMALLOC(len, 0, DYNAMIC_TYPE_OPENSSL);

From 8539e8c1706782725676d17c3994ce203620f1c8 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 12:10:40 +0100
Subject: [PATCH 31/55] Fixed CID 584000.

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index dc97170c1..a4ef05752 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -47482,7 +47482,7 @@ int wolfSSL_a2i_ASN1_INTEGER(WOLFSSL_BIO *bio, WOLFSSL_ASN1_INTEGER *asn1,
         XFREE(asn1->data, NULL, DYNAMIC_TYPE_OPENSSL);
         asn1->isDynamic = 0;
     }
-    XMEMSET(asn1->intData, 0, sizeof(WOLFSSL_ASN1_INTEGER));
+    XMEMSET(asn1->intData, 0, sizeof(WOLFSSL_ASN1_INTEGER_MAX));
     asn1->data = asn1->intData;
     asn1->length = 0;
     asn1->negative = 0;

From 8588998234d9da01a718d96a9994d2efc904db80 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 12:22:59 +0100
Subject: [PATCH 32/55] Fixed CID 586797.

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index a4ef05752..3b6ad2cba 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -23792,7 +23792,7 @@ int wolfSSL_sk_CIPHER_description(WOLFSSL_CIPHER* cipher)
     strLen = (int)XSTRLEN(name);
 
     for (i = 0, j = 0, k = 0; i <= strLen; i++) {
-        if (k > MAX_SEGMENTS || j > MAX_SEGMENT_SZ)
+        if (k >= MAX_SEGMENTS || j >= MAX_SEGMENT_SZ)
             break;
 
         if (name[i] != '-' && name[i] != '\0') {

From f7fbd0fceb0ebcd6f340627f6eb5c5362369f8c9 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 13:35:27 +0100
Subject: [PATCH 33/55] Fixed CID 587287.

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 3b6ad2cba..dcc89357d 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -9096,7 +9096,7 @@ int wolfSSL_X509V3_EXT_print(WOLFSSL_BIO *out, WOLFSSL_X509_EXTENSION *ext,
                         return rc;
                     }
                     if (sk->next)
-                        XSNPRINTF(val, len, "%*s%s, ", indent, "", str->strData);
+                        XSNPRINTF(val, len, "%*s%s,", indent, "", str->strData);
                     else
                         XSNPRINTF(val, len, "%*s%s", indent, "", str->strData);
 

From 9732f6e74b21e760845d03192943a407659bafd4 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 14:27:47 +0100
Subject: [PATCH 34/55] Fixed CID 587328.

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index dcc89357d..2d8804905 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -45580,7 +45580,7 @@ int wolfSSL_X509_NAME_print_ex(WOLFSSL_BIO* bio, WOLFSSL_X509_NAME* name,
 #if defined(WOLFSSL_APACHE_HTTPD) || defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX)
     int count = 0, len = 0, totalSz = 0, tmpSz = 0;
     char tmp[ASN_NAME_MAX+1];
-    char fullName[ASN_NAME_MAX];
+    char fullName[ASN_NAME_MAX+1];
     const char *buf = NULL;
     WOLFSSL_X509_NAME_ENTRY* ne;
     WOLFSSL_ASN1_STRING* str;

From 97a9938f94878452213cea6da5d9403a27ea80ac Mon Sep 17 00:00:00 2001
From: David Kubasek <dkubase@ra.rockwell.com>
Date: Fri, 5 Mar 2021 14:43:52 +0100
Subject: [PATCH 35/55] Fixed CID 584275

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 36acaaac2..28b39ffcf 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -24696,7 +24696,7 @@ static WOLFSSL_X509* d2i_X509orX509REQ_bio(WOLFSSL_BIO* bio,
     }
 
     size = wolfSSL_BIO_get_len(bio);
-    if (size == 0) {
+    if (size <= 0) {
         WOLFSSL_MSG("wolfSSL_BIO_get_len error. Possibly no pending data.");
         return NULL;
     }

From d01d32b6ed0cbc52c5436070d27eaa50a025a504 Mon Sep 17 00:00:00 2001
From: David Kubasek <dkubase@ra.rockwell.com>
Date: Fri, 5 Mar 2021 14:59:18 +0100
Subject: [PATCH 36/55] Fixed the fix of CID 578018

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index d1e878e16..33092daf2 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -40281,7 +40281,7 @@ void* wolfSSL_GetDhAgreeCtx(WOLFSSL* ssl)
                 WOLFSSL_MSG("Serial size error");
                 return WOLFSSL_FAILURE;
             }
-            if (sizeof(cert->serial) < serialSz) {
+            if ((int)sizeof(cert->serial) < serialSz) {
                 WOLFSSL_MSG("Serial buffer too small");
                 return BUFFER_E;
             }

From e76da394b7d98540519330fe63c14c5e94d142f5 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 15:44:00 +0100
Subject: [PATCH 37/55] Fixed CID 587287.

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 33092daf2..097e71c74 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -9040,7 +9040,7 @@ int wolfSSL_X509V3_EXT_print(WOLFSSL_BIO *out, WOLFSSL_X509_EXTENSION *ext,
     int nid;
     const int sz = CTC_NAME_SIZE*2;
     int rc = WOLFSSL_FAILURE;
-    char tmp[CTC_NAME_SIZE*2] = {0};
+    char tmp[CTC_NAME_SIZE*2 + 1] = {0};
     WOLFSSL_ENTER("wolfSSL_X509V3_EXT_print");
 
     if ((out == NULL) || (ext == NULL)) {

From af7b1bd25e1a2e3f6642e267c06a21c1f7ed0c83 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Fri, 5 Mar 2021 17:18:34 +0100
Subject: [PATCH 38/55] Fixed CID 587328.

---
 src/ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 097e71c74..963bec6e6 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -45580,7 +45580,7 @@ int wolfSSL_X509_NAME_print_ex(WOLFSSL_BIO* bio, WOLFSSL_X509_NAME* name,
 #if defined(WOLFSSL_APACHE_HTTPD) || defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX)
     int count = 0, len = 0, totalSz = 0, tmpSz = 0;
     char tmp[ASN_NAME_MAX+1];
-    char fullName[ASN_NAME_MAX+1];
+    char fullName[ASN_NAME_MAX+2];
     const char *buf = NULL;
     WOLFSSL_X509_NAME_ENTRY* ne;
     WOLFSSL_ASN1_STRING* str;

From 876cc9239dba6f91a46702a5383e6c30e5dbebc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Fri, 5 Mar 2021 23:16:50 +0100
Subject: [PATCH 39/55] Fixed CID 576574.

---
 wolfcrypt/src/evp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c
index 8f4471e80..930be71c3 100644
--- a/wolfcrypt/src/evp.c
+++ b/wolfcrypt/src/evp.c
@@ -2608,7 +2608,11 @@ int wolfSSL_EVP_DigestSignFinal(WOLFSSL_EVP_MD_CTX *ctx, unsigned char *sig,
     #if !defined(NO_RSA) && !defined(HAVE_USER_RSA)
         case EVP_PKEY_RSA: {
             unsigned int sigSz;
-            int nid = wolfSSL_EVP_MD_type(wolfSSL_EVP_MD_CTX_md(ctx));
+            int nid;
+            const WOLFSSL_EVP_MD *md = wolfSSL_EVP_MD_CTX_md(ctx);
+            if (md == NULL)
+                break;
+            nid = wolfSSL_EVP_MD_type(md);
             if (nid < 0)
                 break;
             ret = wolfSSL_RSA_sign_generic_padding(nid, digest, hashLen,

From 7d9661d75ce9446ebd826a615432dde40c7fa724 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Fri, 5 Mar 2021 23:24:34 +0100
Subject: [PATCH 40/55] Fixed CID 576884.

---
 wolfcrypt/src/evp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c
index 930be71c3..dff9bfea8 100644
--- a/wolfcrypt/src/evp.c
+++ b/wolfcrypt/src/evp.c
@@ -2705,7 +2705,11 @@ int wolfSSL_EVP_DigestVerifyFinal(WOLFSSL_EVP_MD_CTX *ctx,
         switch (ctx->pctx->pkey->type) {
     #if !defined(NO_RSA) && !defined(HAVE_USER_RSA)
         case EVP_PKEY_RSA: {
-            int nid = wolfSSL_EVP_MD_type(wolfSSL_EVP_MD_CTX_md(ctx));
+            int nid;
+            const WOLFSSL_EVP_MD *md = wolfSSL_EVP_MD_CTX_md(ctx);
+            if (md == NULL)
+                return WOLFSSL_FAILURE;
+            nid = wolfSSL_EVP_MD_type(md);
             if (nid < 0)
                 return WOLFSSL_FAILURE;
             return wolfSSL_RSA_verify_ex(nid, digest, hashLen, sig,

From 5841ee8efb76fba64a32091f63493138b3331c1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Fri, 5 Mar 2021 23:40:49 +0100
Subject: [PATCH 41/55] Fixed CID 576945.

---
 src/crl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/crl.c b/src/crl.c
index 750ac65fc..506c3b586 100644
--- a/src/crl.c
+++ b/src/crl.c
@@ -702,7 +702,8 @@ int wolfSSL_X509_STORE_add_crl(WOLFSSL_X509_STORE *store, WOLFSSL_X509_CRL *newc
     if (store->cm->crl == NULL) {
         crl = wolfSSL_X509_crl_new(store->cm);
         if (DupX509_CRL(crl, newcrl) != 0) {
-            FreeCRL(crl, 1);
+            if (crl != NULL)
+                FreeCRL(crl, 1);
             return WOLFSSL_FAILURE;
         }
         store->crl = store->cm->crl = crl;

From c2629d34b5f71bccd34cbefb3c57a3be65ff44ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Sat, 6 Mar 2021 00:07:37 +0100
Subject: [PATCH 42/55] Fixed CID 577166, 577196.

---
 wolfcrypt/src/evp.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c
index dff9bfea8..48d429def 100644
--- a/wolfcrypt/src/evp.c
+++ b/wolfcrypt/src/evp.c
@@ -2156,7 +2156,10 @@ int wolfSSL_EVP_SignFinal(WOLFSSL_EVP_MD_CTX *ctx, unsigned char *sigret,
     switch (pkey->type) {
 #if !defined(NO_RSA) && !defined(HAVE_USER_RSA)
     case EVP_PKEY_RSA: {
-        int nid = wolfSSL_EVP_MD_type(wolfSSL_EVP_MD_CTX_md(ctx));
+        int nid;
+        const WOLFSSL_EVP_MD *ctxmd = wolfSSL_EVP_MD_CTX_md(ctx);
+        if (ctxmd == NULL) break;
+        nid = wolfSSL_EVP_MD_type(ctxmd);
         if (nid < 0) break;
         return wolfSSL_RSA_sign(nid, md, mdsize, sigret,
                                 siglen, pkey->rsa);
@@ -2232,7 +2235,10 @@ int wolfSSL_EVP_VerifyFinal(WOLFSSL_EVP_MD_CTX *ctx,
     switch (pkey->type) {
 #if !defined(NO_RSA) && !defined(HAVE_USER_RSA)
     case EVP_PKEY_RSA: {
-        int nid = wolfSSL_EVP_MD_type(wolfSSL_EVP_MD_CTX_md(ctx));
+        int nid;
+        const WOLFSSL_EVP_MD *ctxmd = wolfSSL_EVP_MD_CTX_md(ctx);
+        if (ctxmd == NULL) break;
+        nid = wolfSSL_EVP_MD_type(ctxmd);
         if (nid < 0) break;
         return wolfSSL_RSA_verify(nid, md, mdsize, sig,
                 (unsigned int)siglen, pkey->rsa);

From db275268a16d1a9d8a4918b4f184cfa46d6a23f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Sat, 6 Mar 2021 00:40:08 +0100
Subject: [PATCH 43/55] Fixed CID 581667.

---
 src/ssl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/ssl.c b/src/ssl.c
index 963bec6e6..dd17faa44 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -42335,6 +42335,10 @@ err:
             const char* name = wolfSSL_OBJ_nid2ln(wolfSSL_OBJ_obj2nid(a));
 #endif
 
+            if (name == NULL) {
+                WOLFSSL_MSG("Name not found");
+                return WOLFSSL_FAILURE;
+            }
             if (XSTRLEN(name) + 1 < (word32)bufLen - 1) {
                 bufSz = (int)XSTRLEN(name);
             }

From 5efd0bf2a437a04f61975aba71925781ba0f7175 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Sat, 6 Mar 2021 00:58:39 +0100
Subject: [PATCH 44/55] Fixed CID 587445.

---
 src/ssl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ssl.c b/src/ssl.c
index dd17faa44..36ae2502b 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -31897,6 +31897,7 @@ int SetDhExternal(WOLFSSL_DH *dh)
 
     if (dh == NULL || dh->internal == NULL) {
         WOLFSSL_MSG("dh key NULL error");
+        return WOLFSSL_FATAL_ERROR;
     }
 
     key = (DhKey*)dh->internal;

From 9e68d0d1a8900215a004ee6ef4ee650ce3047b6b Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Tue, 9 Mar 2021 12:30:39 +0100
Subject: [PATCH 45/55] Fixed CID 586938

---
 src/internal.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/internal.c b/src/internal.c
index e48085de1..639cd1c1a 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -9798,9 +9798,13 @@ int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
             } else {
                 wolfSSL_ASN1_OBJECT_free(x509->key.algor->algorithm);
             }
-            if (!(x509->key.algor->algorithm =
-                    wolfSSL_OBJ_nid2obj(dCert->keyOID))) {
-                ret = PUBLIC_KEY_E;
+            if (!x509->key.algor) {
+                ret = MEMORY_E;
+            } else {
+                if (!(x509->key.algor->algorithm =
+                        wolfSSL_OBJ_nid2obj(dCert->keyOID))) {
+                    ret = PUBLIC_KEY_E;
+                }
             }
 
             wolfSSL_EVP_PKEY_free(x509->key.pkey);

From dc1f11666d4d7f7c821623649d8c23f85a8ace54 Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Tue, 9 Mar 2021 14:49:30 +0100
Subject: [PATCH 46/55] Fixed CID 588443

---
 src/ssl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 36ae2502b..7a33e4977 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -20276,8 +20276,11 @@ int wolfSSL_NCONF_load(WOLFSSL_CONF *conf, const char *file, long *eline)
             }
 
             sectionName[sectionNameLen] = '\0';
-            if (!(section = wolfSSL_CONF_get_section(conf, sectionName)))
+            if (!(section = wolfSSL_CONF_get_section(conf, sectionName))) {
                 section = wolfSSL_CONF_new_section(conf, sectionName);
+                if (!section)
+                    goto cleanup;
+            }
         }
         else {
             char* name;

From 9f9bf7345ba374b9fa559d8c0c4e3b7104f7ef52 Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Tue, 9 Mar 2021 15:12:31 +0100
Subject: [PATCH 47/55] Fixed CID 13482

---
 src/internal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index 639cd1c1a..88100e4a0 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -21495,7 +21495,7 @@ exit_dpk:
             ato16(input + *inOutIdx, &len);
             *inOutIdx += OPAQUE16_LEN;
 
-            if ((*inOutIdx - begin) + len > size)
+            if ((len > size) || ((*inOutIdx - begin) + len > size))
                 return BUFFER_ERROR;
 
             if (PickHashSigAlgo(ssl, input + *inOutIdx, len) != 0 &&

From a8abeeb50e3e6af440dc70ef8275dd264d772b71 Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Mon, 22 Mar 2021 09:47:52 +0100
Subject: [PATCH 48/55] Fixed CID 58787.

---
 src/internal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index 88100e4a0..eeddb1541 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -7098,7 +7098,7 @@ int DtlsMsgSet(DtlsMsg* msg, word32 seq, word16 epoch, const byte* data, byte ty
 {
     WOLFSSL_ENTER("DtlsMsgSet()");
     if (msg != NULL && data != NULL && msg->fragSz <= msg->sz &&
-                                             (fragOffset + fragSz) <= msg->sz) {
+                    fragOffset <= msg->sz && (fragOffset + fragSz) <= msg->sz) {
         DtlsFrag* cur = msg->fragList;
         DtlsFrag* prev = cur;
         DtlsFrag* newFrag;

From 2e25c531117f91b9a2c9c023b2f51e67f007a62f Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Mon, 22 Mar 2021 09:50:20 +0100
Subject: [PATCH 49/55] Revert "Fixed CID 583215."

This reverts commit 26578be1a792a600091d936139252767d2c25e8a.
---
 src/ocsp.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/ocsp.c b/src/ocsp.c
index 427c1a34c..a8713b8ae 100644
--- a/src/ocsp.c
+++ b/src/ocsp.c
@@ -625,7 +625,6 @@ WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_cert_to_id(
         if (certStatus)
             XFREE(certStatus, NULL, DYNAMIC_TYPE_OPENSSL);
 
-        wolfSSL_CertManagerFree(cm);
         return NULL;
     }
 

From ee79e1082aa9d8cf1420518b23077063beca654a Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Tue, 23 Mar 2021 13:19:32 +0100
Subject: [PATCH 50/55] Updated fix of 58787.

---
 src/internal.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index eeddb1541..42ac95fce 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -7098,7 +7098,8 @@ int DtlsMsgSet(DtlsMsg* msg, word32 seq, word16 epoch, const byte* data, byte ty
 {
     WOLFSSL_ENTER("DtlsMsgSet()");
     if (msg != NULL && data != NULL && msg->fragSz <= msg->sz &&
-                    fragOffset <= msg->sz && (fragOffset + fragSz) <= msg->sz) {
+        fragSz <= msg->sz && fragOffset <= msg->sz &&
+        (fragOffset + fragSz) <= msg->sz) {
         DtlsFrag* cur = msg->fragList;
         DtlsFrag* prev = cur;
         DtlsFrag* newFrag;

From bf1482a2d70b98211a82f1640d22fc49f82cdd61 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 24 Mar 2021 17:05:02 +0100
Subject: [PATCH 51/55] Fixed another CID 529732.

---
 src/ssl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/ssl.c b/src/ssl.c
index 7a33e4977..1d32c392b 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -38546,7 +38546,10 @@ int wolfSSL_RSA_print(WOLFSSL_BIO* bio, WOLFSSL_RSA* rsa, int offset)
                 return WOLFSSL_FAILURE;
             }
             XMEMSET(rawKey, 0, rawLen);
-            mp_to_unsigned_bin(rsaElem, rawKey);
+            if (mp_to_unsigned_bin(rsaElem, rawKey) < 0) {
+                XFREE(rawKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                return WOLFSSL_FAILURE;
+            }
             if ((word32)rawLen <= sizeof(word32)) {
                 idx = *(word32*)rawKey;
                 #ifdef BIG_ENDIAN_ORDER

From 7f64950da4ac0720120e43571686c845663cebf4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kin=C4=8Dl?= <mkincl@ra.rockwell.com>
Date: Wed, 24 Mar 2021 17:23:49 +0100
Subject: [PATCH 52/55] Fixed fix of CID 576329.

---
 src/ssl.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/ssl.c b/src/ssl.c
index 1d32c392b..b94917875 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -50235,11 +50235,11 @@ int wolfSSL_BN_clear_bit(WOLFSSL_BIGNUM* bn, int n)
 #ifdef WOLFSSL_SMALL_STACK
        tmp = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_BIGINT);
        if (tmp == NULL) {
-           goto cleanup;
+           goto end;
        }
 #endif
         if (mp_init(tmp) != MP_OKAY) {
-            goto cleanup;
+            goto end;
         }
         if (mp_set_bit(tmp, n) != MP_OKAY) {
             goto cleanup;
@@ -50247,16 +50247,19 @@ int wolfSSL_BN_clear_bit(WOLFSSL_BIGNUM* bn, int n)
         if (mp_sub((mp_int*)bn->internal, tmp, (mp_int*)bn->internal) != MP_OKAY) {
             goto cleanup;
         }
+    } else {
+        goto end;
     }
 
     ret = WOLFSSL_SUCCESS;
 cleanup:
     mp_clear(tmp);
+
+end:
 #ifdef WOLFSSL_SMALL_STACK
     if (tmp)
         XFREE(tmp, NULL, DYNAMIC_TYPE_BIGINT);
 #endif
-end:
     return ret;
 }
 

From 67d4611fda6e9c0fe8314b7ef13dd0c3d6df8bd3 Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Thu, 25 Mar 2021 11:26:34 +0100
Subject: [PATCH 53/55] Review fixes.

---
 src/ssl.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/ssl.c b/src/ssl.c
index b94917875..540a13581 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -47493,7 +47493,7 @@ int wolfSSL_a2i_ASN1_INTEGER(WOLFSSL_BIO *bio, WOLFSSL_ASN1_INTEGER *asn1,
         XFREE(asn1->data, NULL, DYNAMIC_TYPE_OPENSSL);
         asn1->isDynamic = 0;
     }
-    XMEMSET(asn1->intData, 0, sizeof(WOLFSSL_ASN1_INTEGER_MAX));
+    XMEMSET(asn1->intData, 0, WOLFSSL_ASN1_INTEGER_MAX);
     asn1->data = asn1->intData;
     asn1->length = 0;
     asn1->negative = 0;
@@ -50012,8 +50012,8 @@ WOLFSSL_BIGNUM* wolfSSL_BN_bin2bn(const unsigned char* str, int len,
             return NULL;
         }
     } else {
-	/* This may be overly defensive */
-	if (weOwn)
+        /* This may be overly defensive */
+        if (weOwn)
             wolfSSL_BN_free(ret);
         return NULL;
     }

From fd7131197f0efda98a4a2731a23070b04a2dbd42 Mon Sep 17 00:00:00 2001
From: Radim Smat <rsmat@ra.rockwell.com>
Date: Thu, 25 Mar 2021 13:28:47 +0100
Subject: [PATCH 54/55] Updated fix of CID 587269.

---
 src/ssl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/ssl.c b/src/ssl.c
index 540a13581..6ff820092 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -41545,6 +41545,10 @@ err:
             return BAD_FUNC_ARG;
         }
 
+        if (*info == NULL) {
+            return BAD_FUNC_ARG;
+        }
+
         /* check is fresh "info" passed in, if not free it */
         if ((*info)->x509 != NULL || (*info)->x_pkey != NULL) {
             WOLFSSL_X509_INFO* tmp;

From 6c7b3d806affc01aec185761da75e24ee7c8b248 Mon Sep 17 00:00:00 2001
From: Stanislav Klima <sklima@ra.rockwell.com>
Date: Thu, 25 Mar 2021 15:36:30 +0100
Subject: [PATCH 55/55] Fixed modifying a const value.

---
 src/internal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index 42ac95fce..22da068fb 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -1113,7 +1113,7 @@ static int dtls_export_load(WOLFSSL* ssl, const byte* exp, word32 len, byte ver)
     }
 #else
     if (ver > DTLS_EXPORT_VERSION_3) {
-        exp[idx++] = 0;
+        idx++;
     }
 #endif
 #else