Harden wolfTPM examples fwTPM and SPDM error handling and secret zeroization

[aidangarske]

F-9172, F-9173, F-9174, F-9175, F-9176, F-9177, F-9179, F-9180, F-9182, F-9185, 
F-9193, F-9194, F-10760, F-10762, F-10763, F-10824, F-11891, F-11901, F-11903, 
F-11908, F-11909, F-11916, F-11929, F-11930, F-11931, F-11932, F-11933, F-11934, 
F-12707, F-12713, F-12753, F-12755, F-13452, F-13453, F-13457, F-13461, F-13463, 
F-13467, F-13498, F-13499, F-13529, F-13530, F-13531, F-13532

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Hardens wolfTPM / fwTPM / SPDM code paths by tightening input validation, improving protocol/state handling, and ensuring sensitive buffers are reliably wiped and released on error.

Changes:

• Add secret zeroization and safer cleanup across TPM, fwTPM NV/crypto/command, and HAL paths.
• Strengthen SPDM framing/length validation and adjust sequence-number handling.
• Improve example robustness by propagating failures and avoiding partial/ambiguous states.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/tpm2_wrap.c	Zeroizes temporary auth/session material on early failure paths.
src/spdm/spdm_tcg.c	Adds vendor-defined payload validation (NULL/size and 16-bit length overflow guard).
src/spdm/spdm_secured.c	Adds req sequence bounds check and changes when rsp sequence advances.
src/spdm/spdm_responder.c	Makes PSK provisioning atomic-ish and validates PSK exchange request field lengths.
src/spdm/spdm_nuvoton.c	Returns framing error on unexpected status response shape.
src/spdm/spdm_nations.c	Returns framing error on unexpected status response shape.
src/spdm/spdm_msg.c	Tightens KeyExchange build-size requirements per platform config.
src/spdm/spdm_context.c	Clarifies disconnect behavior regarding which keys are wiped.
src/fwtpm/fwtpm_tis.c	Adds compile-time check to prevent FIFO size mismatches.
src/fwtpm/fwtpm_nv.c	Zeroizes NV temp buffers before resize/free and on exit.
src/fwtpm/fwtpm_crypto.c	Avoids freeing uninitialized HMAC and gates RNG block generation on prior success.
src/fwtpm/fwtpm_command.c	Adds request validation, constant-time compares, auth-area skipping, and broad cmdAuths zeroization.
src/fwtpm/fwtpm.c	Cleans up wolfCrypt only when successfully initialized.
hal/tpm_io_espressif.c	Zeroizes temporary hex log buffer after printing.
hal/tpm_io.c	Adds argument validation before building SPI frame and copying buffers.
examples/wrap/hash.c	Unloads TPM handle before device cleanup.
examples/wrap/getrandom.c	Rejects negative length argument.
examples/wrap/caps.c	Normalizes return code after printing handle count.
examples/pkcs7/pkcs7.c	Prevents PKCS7 resource leaks/double-free on error paths.
examples/pcr/policy_sign.c	Avoids exporting signature components when signing fails.
examples/pcr/policy.c	Fixes string prefix check and returns proper error codes on bad args.
examples/management/flush.c	Propagates FlushContext return code.
examples/gpio/gpio_config.c	Returns error on vendor mismatch instead of silently continuing.
examples/firmware/ifx_fw_update.c	Returns BAD_FUNC_ARG when required file args are missing.
examples/bench/bench.c	Adjusts TPM RC masking for “hash not supported” handling.
examples/attestation/make_credential.c	Treats AK name file open/read failures as errors and exits cleanly.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.