Invalidate cached STACK_OF(X509_REVOKED) when the CRL list head changes

[gasbytes]

Description

Clear crl->revokedStack in AddCrl() and SwpLists(), under the write lock they already hold.

Testing

Added a regression test that reproduces the behaviour (test_wolfSSL_X509_CRL_get_REVOKED_after_update), which loads a newer CRL over it, and checks the second read reports the new serial.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

This PR fixes a stale-cache issue where crl->revokedStack (the cached STACK_OF(X509_REVOKED)) can remain built from an old CRL after the CRL list head is updated/replaced.

Changes:

• Invalidate crl->revokedStack in AddCRL() and SwapLists() when CRL list updates occur.
• Add a regression test that loads a CRL, builds the revoked cache, then updates the CRL and verifies the revoked serial changes.
• Register the new regression test in the API test suite.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
tests/api.c	Adds and registers a regression test to ensure revoked-stack caching is refreshed after a CRL update.
src/crl.c	Clears the cached revoked stack when CRL head/list swaps occur to avoid returning stale revoked entries.

Suppressed comments (1)

tests/api.c:1

• This assertion checks the raw ASN.1 integer encoding (length/data) rather than the integer value, which can make the test more brittle if the underlying representation changes (even if the value is the same). If there is an accessor to retrieve the integer value (e.g., an ASN1_INTEGER_get-style API in wolfSSL), prefer asserting on the numeric value instead of encoding details.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m4-pkcs7