Use refcount on DER buffer to prevent UAF

[padelsbach]

Description

This change fixes a use-after-free when the certificate is updated in the SNI callback (triggered by the clienthello). The certificate and certChain buffer are pointed to by both the WOLFSSL object and the WOLFSSL_CTX object, and a call to wolfSSL_CTX_use_certificate_file() triggers a free+null of the pointers in CTX but not the SSL object.

Observable failure is an ASAN read failure in wolfSSL_accept_TLSv13. Requires HAVE_SNI enabled.

Fix is to add reference counter on the shared DerBuffer.

Fixes zd 22107.

Testing

TDD using new unit test.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +28 B (+0.0%, 64,135 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m3

• FLASH: .text +60 B (+0.0%, 122,281 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 199,966 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +64 B (+0.0%, 174,378 B / 262,144 B, total: 67% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 180,696 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +64 B (+0.1%, 61,741 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 769,812 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 279,112 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 324,712 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +64 B (+0.1%, 61,741 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 123,021 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 235,792 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 199,966 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 279,688 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 235,856 B / 262,144 B, total: 90% used)

linuxkm-pie

• Data: __patchable_function_entries +8 B (+0.0%, 25,424 B)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 48,056 B)
  No memory changes detected for:
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-pkcs7
• stm32-sim-stm32h753