Fix wolfSSL_get_ciphers_compat() to return NULL for empty cipher list

[cconlon]

Description

This PR fixes wolfSSL_get_ciphers_compat() to return NULL when no cipher suites pass filtering, instead of returning a non-NULL empty stack.

The refactoring of wolfSSL_get_ciphers_compat() in commit fb82496 (PR #9831) changed the function to pre-allocate the cipher stack before the population loop. When all ciphers are filtered out, the function now returns a non-NULL empty stack instead of NULL.

Since wolfSSL_get_ciphers_compat() is defined as SSL_get_ciphers(), it should return NULL when no ciphers are available, consistent with OpenSSL behavior (the pre-refactoring behavior).

Testing

Adds regression test test_wolfSSL_get_ciphers_compat_empty(). Caught when running wolfssljni JUnit tests.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Fixes wolfSSL_get_ciphers_compat() to match OpenSSL semantics by returning NULL when cipher filtering results in no available ciphers, and adds a regression test to prevent reintroducing the behavior.

Changes:

• Free and null out the cached cipher stack when it ends up empty after filtering.
• Add a regression test ensuring wolfSSL_get_ciphers_compat() returns NULL (not an empty stack) when no ciphers are available.
• Register the new test in the OPENSSL_ALL test suite list.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tests/api.c	Adds and registers a regression test for the empty-cipher-list NULL return behavior.
src/ssl.c	Adjusts wolfSSL_get_ciphers_compat() to free an empty stack and return NULL.

Comments suppressed due to low confidence (1)

tests/api.c:1

• This test relies on SSL_OP_NO_TLSv1_3 being defined. If that macro is not available in some build configurations (e.g., certain feature-disable builds), this will fail to compile. To keep the test portable across configurations, guard use of SSL_OP_NO_TLSv1_3 with a preprocessor check (or build the options mask conditionally) so the test still compiles while disabling all supported protocol versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JacobBarthelmeh]

Retest this please Jenkins PRB-FIPS-windows-test-ACVP