24062026 Coverity fixes

[rlm2002]

Description

• Logically dead code
  • 561219: remove XBADFILE check
  • 561215/561216: remove dead check
• Untrusted loop bound
  • 561218: Add bounds check to test helper
• Overflowed return value
  • 561217: move casts and harden function
• Unchecked return value
• 561216/561205: Remove call to remove(pubFile/privFile), add (void) cast
• Assign instead of compare
  • 561214: change ExpectTrue() to assignment
• Untrusted pointer read
  • 561207: Bound tainted lengths in ECH test helper

Testing

./configure --enable-all && make check

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 1 total — 1 posted, 0 skipped
1 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Info] *Adjacent dead data == NULL check left in place after dead-code cleanup — src/ocsp.c:1189-1192

Review generated by Skoll

[dgarske]

*⚪ [Info] Adjacent dead data == NULL check left in place after dead-code cleanup

This PR removes the redundant if (len <= 0) return NULL; because line 1189 (if (data == NULL || *data == NULL || len <= 0) return NULL;) already covers it. That same combined guard also already covers the immediately-following if (*data == NULL) return NULL; on lines 1191-1192, which is therefore unreachable/dead in exactly the same way. This is pre-existing (the diff did not add it), so it is out of strict scope, but since the PR's stated theme is removing logically-dead code, a reviewer would reasonably remove this adjacent duplicate at the same time. No correctness impact either way.

Fix: Optionally drop the redundant if (*data == NULL) return NULL; for consistency with the dead-code cleanup in this PR. Not blocking; pre-existing and harmless.

[rlm2002]

Fix applied, thanks.