Compat layer: escape control characters in X509 print output

[padelsbach]

Description

Escape control characters in the compat layer print functions, matching
OpenSSL. Previously certificate, CRL and CSR fields were printed as-is,
so a crafted certificate could inject content into the output:

• CR/LF can add fake lines, such as a second Subject: or alt name, to
  output that applications log or show to users
• ESC can add terminal escape sequences when the output goes to a
  terminal

Fixes issues:
-M05-2
-M05-3
-M05-4
-M05-5
-M05-6
-M05-7
-M05-8
-M05-9
-M19-2

Testing

Added unit tests

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata -24 B, .text +256 B (+0.0%, 792,516 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 308,656 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .rodata -8 B, .text +2,432 B (+0.7%, 340,904 B / 1,048,576 B, total: 33% used)

linuxkm-standard

• Data: __patchable_function_entries +16 B (+0.0%, 51,608 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• stm32-sim-stm32h753

[Copilot]

🟡 Changes recommended

Some general-name paths remain injectable, and expanded values can unexpectedly make printing fail.

2 open findings

• Avoid fixed output limit failures after control-character escaping · New
• Escape CR/LF in all GENERAL_NAME_print branches · New

What changed in this PR

Adds control-character escaping to OpenSSL-compatible X.509 print output.

Changes:

• Escapes control characters in certificate, CRL, CSR, SAN, and ACERT fields.
• Adds regression tests and a memory-BIO test helper.
• Corrects verification parameter hostFlags inheritance.

File	Description
src/​x509.c	Implements escaping and hostFlags inheritance.
wolfssl/​openssl/​x509.h	Enables control escaping for one-line names.
tests/​utils.c	Adds memory-BIO conversion helper.
tests/​utils.h	Declares the BIO helper.
tests/​api.c	Tests certificate, CRL, CSR, and SAN output.
tests/​api/​test_ossl_x509_acert.c	Tests ACERT escaping.
tests/​api/​test_ossl_x509_acert.h	Registers the ACERT test.
tests/​api/​test_ossl_x509_vp.c	Tests hostFlags inheritance.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[padelsbach]

jenkins retest this please