From 99a51c1891524236ce976651a8e573ce62d25cbf Mon Sep 17 00:00:00 2001
From: Daniele Lacamera <root@danielinux.net>
Date: Wed, 5 Aug 2026 15:15:49 +0200
Subject: [PATCH] pkcs7: retain certificates after SignedData encode

PKCS7_EncodeSigned() freed the object's certificate-list nodes after a successful encode while leaving the signer fields populated. Reusing the object then emitted SignedData without certificates, requiring external signature verification.

Keep the list until wc_PKCS7_Free(), which already handles its cleanup.
---
 wolfcrypt/src/pkcs7.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index d9f1dbb172..c3b929322d 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -4124,8 +4124,6 @@ static int PKCS7_EncodeSigned(wc_PKCS7* pkcs7,
         }
     }
 
-    wc_PKCS7_FreeCertSet(pkcs7);
-
     wc_PKCS7_WriteOut(pkcs7, (output2)? (output2 + idx) : NULL,
                 esd->signerInfoSet, esd->signerInfoSetSz);
     idx += (int)esd->signerInfoSetSz;