Reject truncated or malformed ML-KEM encapsulation results

[aidangarske]

• TPM2_Encapsulate trimmed oversized lengths instead of rejecting them, and returned success with a ciphertext size larger than
  the bytes it actually received.
• Adds TPM2_Packet_ParseU16BufStrict, which returns TPM_RC_SIZE instead of trimming. TPM2_Encapsulate and TPM2_Decapsulate use it
  and clear the shared secret on failure.
• wolfTPM2_Encapsulate and wolfTPM2_Decapsulate now require the exact FIPS 203 sizes for ML-KEM keys: a 768, 1088 or 1568-byte
  ciphertext and a 32-byte shared secret.
• Adds a unit test for the strict parser. The existing fwTPM ML-KEM encapsulate, decapsulate and round-trip tests still pass.

Reported by Vishnu Ajith @Vishnu2707

ZD #225560

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #621

Scan targets checked: wolftpm-src, wolftpm-bugs
Coverage: 4 of 5 in-scope changed file(s) opened by the reviewer; not opened: wolftpm/tpm2_packet.h

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

Review effort: Lite
Findings: 4

Open (4)

• On parse failure you zero out->sharedSecret but only set out->ciphertext.size = 0 without… · New
• This helper returns BAD_FUNC_ARG on NULL inputs, but callers in src/tpm2.c use the return value… · New
• MlKemCiphertextSize() returns 0 for unknown parameter sets, but the caller treats any mismatch as… · New
• TPM2_Packet_ParseU16BufStrict is declared as WOLFTPM_TEST_API, but it is now used by production… · New

What changed in this PR

This PR introduces stricter parsing for UINT16-length-prefixed buffers (fail on oversize/truncation instead of truncating) and adds ML-KEM output size validation, along with a unit test for the new strict parser.

Changes:

• Added TPM2_Packet_ParseU16BufStrict() API and unit tests to enforce non-truncating parsing behavior.
• Updated TPM2_Encapsulate/TPM2_Decapsulate response parsing to use strict parsing and sanitize outputs on parse failure.
• Added ML-KEM ciphertext/shared-secret size validation in wrapper APIs.

File	Description
wolftpm/​tpm2_packet.h	Declares new strict parsing API.
src/​tpm2_packet.c	Implements strict parsing helper for UINT16-prefixed buffers.
src/​tpm2.c	Switches Encapsulate/Decapsulate response parsing to strict parsing + sanitization.
src/​tpm2_wrap.c	Adds ML-KEM output size sanity checks post-TPM call.
tests/​unit_tests.c	Adds unit test coverage for strict parsing helper.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Session parameter boundaries and decapsulation ciphertext sizes are not fully validated.

Review effort: Balanced
Findings: 1

Open (1)

• Bound sessioned response parsing to the declared parameter area · New

Resolved since last review (4)

• TPM2_Packet_ParseU16BufStrict is declared as WOLFTPM_TEST_API, but it is now used by production…
• MlKemCiphertextSize() returns 0 for unknown parameter sets, but the caller treats any mismatch as…
• This helper returns BAD_FUNC_ARG on NULL inputs, but callers in src/tpm2.c use the return value…
• On parse failure you zero out->sharedSecret but only set out->ciphertext.size = 0 without…