Address review feedback

- LoadFile now validates fread read the full file size and returns NULL
  on short read.
- ocsp-responder-http checks wolfSSL_Init return value.
- Remove bare scope block around sigaction setup.

Author: julek-wolfssl

ocsp/responder/ocsp-load-certs.h

@@ -46,6 +46,7 @@ static WC_MAYBE_UNUSED byte* LoadFile(const char* path, int* outSz)
     if (!buf) { fclose(f); return NULL; }
     *outSz = (int)fread(buf, 1, (size_t)sz, f);
     fclose(f);
+    if (*outSz != (int)sz) { free(buf); return NULL; }
     return buf;
 }
 

ocsp/responder/ocsp-responder-http.c

@@ -237,6 +237,7 @@ int main(int argc, char** argv)
     word32 caSubjectSz = sizeof(caSubject);
     int sockfd = -1, clientfd, opt = 1, i, ret = 0;
     struct sockaddr_in addr;
+    struct sigaction sa;
 
     if (argc < 4) {
         printf("Usage: %s <port> <ca-cert> <ca-key> [good-cert ...]\n\n"
@@ -252,20 +253,21 @@ int main(int argc, char** argv)
     certFile = argv[2];
     keyFile  = argv[3];
 
-    wolfSSL_Init();
-    {
-        struct sigaction sa;
-        sa.sa_handler = sigHandler;
-        sa.sa_flags = 0; /* No SA_RESTART so accept() returns on signal */
-        sigemptyset(&sa.sa_mask);
-        sigaction(SIGINT, &sa, NULL);
-        sigaction(SIGTERM, &sa, NULL);
-
-        /* Ignore SIGPIPE so client disconnections during writes don't crash */
-        sa.sa_handler = SIG_IGN;
-        sigaction(SIGPIPE, &sa, NULL);
+    if (wolfSSL_Init() != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "wolfSSL_Init failed\n");
+        return 1;
     }
 
+    sa.sa_handler = sigHandler;
+    sa.sa_flags = 0; /* No SA_RESTART so accept() returns on signal */
+    sigemptyset(&sa.sa_mask);
+    sigaction(SIGINT, &sa, NULL);
+    sigaction(SIGTERM, &sa, NULL);
+
+    /* Ignore SIGPIPE so client disconnections during writes don't crash */
+    sa.sa_handler = SIG_IGN;
+    sigaction(SIGPIPE, &sa, NULL);
+
     caCertDer = LoadCertDer(certFile, &caCertDerSz);
     caKeyDer = LoadKeyDer(keyFile, &caKeyDerSz);
     if (!caCertDer || !caKeyDer) {