Fix GetSafeContent to check length

[embhorn]

Description

Added bounds check after GetObjectId() in GetSafeContent() to verify the OID didn't consume more bytes than the ContentInfo SEQUENCE declared. Returns ASN_PARSE_E if (localIdx - curIdx) > (word32)curSz, preventing the unsigned integer underflow in the ci->dataSz calculation.

Fixes zd21389

Testing

Added test_wc_d2i_PKCS12_oid_underflow

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Adds a defensive bounds check in PKCS#12 parsing to prevent an unsigned underflow when an encoded OID exceeds the declared ContentInfo SEQUENCE length, and introduces a regression test for the crafted input case.

Changes:

• Add a post-GetObjectId() bounds check in GetSafeContent() to reject OIDs longer than the declared SEQUENCE length.
• Add a new API test exercising the OID-length vs SEQUENCE-length underflow scenario.
• Register the new test in the PKCS#12 API test declarations.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
wolfcrypt/src/pkcs12.c	Adds bounds validation to prevent size underflow during ContentInfo parsing.
tests/api/test_pkcs12.h	Registers the new regression test in the PKCS#12 test list.
tests/api/test_pkcs12.c	Adds a crafted DER test case to ensure the parser rejects the underflow scenario.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.