wolfcrypt_glue.c: wc_rng_free(NULL) asymmetry between BANKREF and non-BANKREF error paths

[cpsource]

Summary

A recent code review of kernel-src/ (full review written up in README-code-review-kernel-src.md on master) turned up one novel minor finding, reported here for tracking.

Finding

File/lines: kernel-src/wolfcrypt_glue.c:580 (in wc_ecc_make_keypair_exim) and kernel-src/wolfcrypt_glue.c:774 (in wc_ecc_shared_secret_exim).

In the #ifdef WC_DRBG_BANKREF branches, wc_rng_free(rng) is called unconditionally at the out: label. rng is initialized to NULL at the top of each function and is only assigned by a successful wc_rng_new_bankref(wc_wg_drbg, &rng). Any error path that jumps to out before (or on failure of) that call will reach wc_rng_free(NULL).

The sibling #else /* !WC_DRBG_BANKREF */ branches at lines 582 and 776 guard the equivalent cleanup with if (rng_inst) before calling put_drbg(rng_inst). The asymmetry is the concern — either both branches should guard or neither should need to.

Severity

Minor — [unverified]. Worst case appears to be a benign BAD_FUNC_ARG return from wc_rng_free(NULL) (consistent with typical wolfSSL API behavior), which is ignored at the call site. No crash path identified. Reporting for symmetry / defensive consistency rather than for a reproducible bug.

Suggested fix

Add if (rng) guards at wolfcrypt_glue.c:580 and :774, mirroring the non-BANKREF branches at :582 and :776.