Buffer sizing, native resource cleanup, and lifecycle fixes

[cconlon]

This PR includes 11 Fenrir fixes:

• F-9991: Size BlockCipher.update() output from requested length instead of the full input array
• F-9992: Validate caller-supplied buffer sizes against actual array lengths in the RsaExportCrtKey before native export
• F-9993: Free active CMAC context with wc_CmacFree() on release and before reinitializing in setKey/reset
• F-9994: Log the requested operation size instead of a fixed AES_BLOCK_SIZE in FIPS GCM decrypt wrapper
• F-9995: Detach natively attached threads and release all local references in the FIPS error callback
• F-9996: Clean up the CertManager mutex and stored JavaVM pointer when JNI_OnLoad fails partway through init
• F-9986 / F-9987 / F-9988: Correct copied import comments in the Curve25519 wrappers
• F-9989 / F-9990: Correct the same copied import comments in the Ed25519 wrappers

[Copilot]

Pull request overview

This PR tightens argument/buffer validation, improves native resource lifecycle handling, and corrects JNI wrapper behavior/comments across several crypto primitives in the wolfCrypt JNI/JCE codebase.

Changes:

• Fix BlockCipher.update() to size returned output based on the requested operation length and add new invalid-length tests for AES/3DES/ECB variants.
• Add defensive buffer-capacity validation for RSA CRT key export and extend tests to cover oversized/negative capacities.
• Improve native cleanup and lifecycle behavior (FIPS callback local ref cleanup + thread detach; JNI_OnLoad partial-init cleanup; CMAC context freeing on reuse), plus correct misleading import comments in Curve25519/Ed25519 JNI wrappers.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/main/java/com/wolfssl/wolfcrypt/BlockCipher.java	Adjusts update() output sizing and adds argument validation for offset/length.
jni/jni_rsa.c	Validates caller-provided RSA export buffer sizes against actual Java array lengths.
src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java	Adds regression tests for invalid RSA export buffer capacities.
src/test/java/com/wolfssl/wolfcrypt/test/AesTest.java	Adds tests ensuring update() sizes output to requested length and rejects invalid ranges.
src/test/java/com/wolfssl/wolfcrypt/test/Des3Test.java	Adds test coverage for rejecting invalid update() ranges.
src/test/java/com/wolfssl/wolfcrypt/test/AesEcbTest.java	Adds test coverage for rejecting invalid update() ranges.
jni/jni_native_struct.c	Ensures partial JNI_OnLoad failures clean up cert manager init and reset stored JavaVM pointer.
jni/jni_fips.c	Ensures FIPS callback releases local refs and detaches threads when it attached them.
jni/jni_aescmac.c	Adds version-gated CMAC context freeing for reset/rekey and native free paths.
src/test/java/com/wolfssl/wolfcrypt/test/AesCmacTest.java	Adds regression test for CMAC reset/rekey behavior mid-stream.
jni/jni_curve25519.c	Corrects copied/misleading import comments in Curve25519 JNI wrappers.
jni/jni_ed25519.c	Corrects copied/misleading import comments in Ed25519 JNI wrappers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.