Wire Length vs. Buffer Bounds: An Out-of-Bounds Write in wolfSSL's Silicon Labs Port
wolfSSL's Silicon Labs ECC import took the coordinate size from the peer's point and the curve from a separate identifier. A 133-byte point on a P-256 session wrote past a 96-byte heap field while the certificate was still being decoded.