[embhorn]

Description

• DhAgree() (src/internal.c): return BUFFER_E when agreeSz is smaller than the DH prime, before calling wc_DhAgree(). The sp_DhExp_ paths and the generic non-ct path write the full secret without checking the buffer.
• wc_DhAgree(): behaviour unchanged. agreeSz is documented as output only, and callers such as hostap pass it uninitialized. The doxygen now states that the input size isn't checked, the buffer must hold the full prime, and wc_DhAgree_ct() is the variant that checks.
• tfm.h / sp_int.h: check the largest FFDHE group against FP_MAX_BITS and SP_INT_BITS once those are final. The settings.h guard only ran when the size was set explicitly, so a defaulted FP_MAX_BITS (4096) with FFDHE-4096 built without error.

Fixes zd22715

Testing

• New API test test_tls13_ffdhe_pms_too_small: a TLS 1.3 FFDHE-2048 handshake with the server's pre-master buffer one byte short fails with BUFFER_E. The test fails without the DhAgree() change.
• wc_DhAgree() with agreeSz = 0 (the hostap pattern) succeeds again.
• testwolfcrypt and unit.test pass for the default build and --enable-fastmath and --enable-all.
• Compile checks: fastmath + FFDHE-4096 with the default FP_MAX_BITS now hits #error; SP_INT_DIGITS set too small for FFDHE-4096 hits #error; valid configs still build.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 208,368 B / 262,144 B, total: 79% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text -128 B (-0.0%, 796,124 B / 1,048,576 B, total: 76% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753
• zephyr-frdm_rw612

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[embhorn]

Changes reviewed and approved by customer