Free every OCSP chain request in TLSX_CSR_Free

[danielinux]

Description

ProcessChainOCSPRequest() stores one OcspRequest per certificate at that
certificate's position in the chain:

request = &csr->request.ocsp[i];   /* i starts at 1, index 0 is the leaf */

csr->requests, however, is a count of calls that completed successfully,
maintained independently of i.

TLSX_CSR_Free() bounded the release by that count:

for (i = 0; i < csr->requests; i++)
    FreeOcspRequest(&csr->request.ocsp[i]);

The two only coincide when index 0 was populated first. Whenever the highest
index written is at or above csr->requests, the tail entries are never
released, and the serial and URL buffers InitOcspRequest() allocated for them
become unreachable.

Valgrind reports them as definitely lost:

InitOcspRequest (asn.c)
  <- CreateOcspRequest (internal.c)
    <- ProcessChainOCSPRequest (tls.c)

This affects OCSP multi-stapling for certificate chains
(--enable-ocspstapling). Functional behaviour is unaffected — every test
passes either way — so it only surfaces under a leak checker.

Fix: walk the whole array rather than a count. FreeOcspRequest() is a no-op
on a request that was never populated, and the array is sized
MAX_CERT_EXTENSIONS, so unpopulated slots cost nothing.

Testing

Discovered through #11222

• Reproducer that populates a request at chain position 1 with csr->requests
  still 0, then frees the WOLFSSL object, run under
  valgrind --leak-check=full:

  • before: definitely lost: 43 bytes in 2 blocks, ERROR SUMMARY: 2 errors
  • after: no leaks, ERROR SUMMARY: 0 errors

  The 20-byte and 23-byte blocks correspond to the serial and URL allocations
  in InitOcspRequest().

• ./tests/unit.test --group ocsp — 0 failures.

• ./wolfcrypt/test/testwolfcrypt — exit 0.

• Configuration used:
  --enable-ocsp --enable-ocspstapling --enable-ocspstapling2 --enable-tls13

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11285

Scan targets checked: wolfssl-bugs, wolfssl-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[philljj]

Retest this please.

(raise TLSAbruptCloseError() in multi-msg-record test)

[philljj]

note: will fix valgrind leak reported in:

• Mcdc test coverage - part 7  #11222

[philljj]

Retest this please.

PRB preflight hung