dh: allow a zero-size export buffer

[yosuke-wolfssl]

Problem

wp_dh_export() computes a single allocation covering both the group data and the key pair, then requires OPENSSL_secure_malloc() to return non-NULL before it exports anything. For a parameter-only named-group key, both contributions are zero: wp_dh_export_group_alloc_size() returns 0 because a named group is exported as a string pointer with no backing buffer, and wp_dh_export_keypair_alloc_size() returns 0 when there are no public or private bytes. OPENSSL_secure_malloc(0) returns NULL, so a key that needed no buffer at all fails to export.

Reachable through EVP_PKEY_todata() and through any cross-provider export of DH domain parameters. Closes f-11557.

Fix (src/wp_dh_kmgmt.c)

Allocate only when the computed size is non-zero:

        /* Named group parameters need no buffer - zero size is valid. */
        if (sz > 0) {
            data = OPENSSL_secure_malloc(sz);
            if (data == NULL) {
                ok = 0;
            }
        }

data stays NULL on that path and is never dereferenced: wp_dh_export_group() touches it only in its explicit-parameters branch, wp_dh_export_keypair() is guarded by pubSz > 0 / privSz > 0, and OPENSSL_secure_clear_free() returns early on a null pointer.

Tests

test_dh_export_named_group_params imports an ffdhe2048 parameter-only key via EVP_PKEY_fromdata(), exports it with EVP_PKEY_todata(), and requires a group name in the result — so it fails on a silently empty export as well as on the error return.

Verification

• Build clean under -Werror; no new compiler warnings.
• Full unit suite: 200/200 pass. DH cases: 15/15.
• Negative control: with the guard reverted the new test fails at Export of parameter-only named group key failed; it passes with the guard in place.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #477

Scan targets checked: wolfprovider-bugs, wolfprovider-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #477

Scan targets checked: wolfprovider-bugs, wolfprovider-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.