From b3f5fd93977d88d122cd709f0f9fd0055e626e7d Mon Sep 17 00:00:00 2001
From: Yosuke Shimizu <yosuke@wolfssl.com>
Date: Fri, 8 May 2026 15:16:36 +0900
Subject: [PATCH] Fix minor issues

---
 apps/wolfssh/common.c |  5 +++--
 src/internal.c        | 15 ++++++++-------
 src/ssh.c             |  2 +-
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/apps/wolfssh/common.c b/apps/wolfssh/common.c
index c93a5aa8c..cedca27d5 100644
--- a/apps/wolfssh/common.c
+++ b/apps/wolfssh/common.c
@@ -225,8 +225,9 @@ static int FingerprintKey(const byte* pubKey, word32 pubKeySz, char* out)
         ret = Base64_Encode_NoNl(digest, sizeof(digest), (byte*)fp, &fpSz);
 
     if (ret == 0) {
-        if (fp[fpSz] == '=') {
-            fp[fpSz] = 0;
+        if (fpSz > 0 && fp[fpSz - 1] == '=') {
+            /* Remove trailing padding */
+            fp[fpSz - 1] = 0;
         }
 
         WSTRCAT(out, "SHA256:");
diff --git a/src/internal.c b/src/internal.c
index b0e264e37..e93c9c3c9 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -4235,7 +4235,7 @@ static word32 AlgoListSz(const char* algoList)
         return 0;
 
     algoListSz = (word32)WSTRLEN(algoList);
-    if (algoList[algoListSz-1] == ',') {
+    if (algoListSz > 0 && algoList[algoListSz-1] == ',') {
         --algoListSz;
     }
 
@@ -8573,11 +8573,10 @@ static int DoUserAuthInfoRequest(WOLFSSH* ssh, byte* buf, word32 len,
     if (ssh == NULL || buf == NULL || len == 0 || idx == NULL)
         ret = WS_BAD_ARGUMENT;
 
-    if (ssh->ctx != NULL) {
-        heap = ssh->ctx->heap;
-    }
-
     if (ret == WS_SUCCESS) {
+        if (ssh->ctx != NULL) {
+            heap = ssh->ctx->heap;
+        }
         begin = *idx;
         ret = GetStringAlloc(heap, (char**)&authName, NULL, buf, len, &begin);
     }
@@ -8653,7 +8652,9 @@ static int DoUserAuthInfoRequest(WOLFSSH* ssh, byte* buf, word32 len,
         ret = SendUserAuthKeyboardResponse(ssh);
     }
 
-    ssh->authId = ID_USERAUTH_KEYBOARD;
+    if (ret == WS_SUCCESS) {
+        ssh->authId = ID_USERAUTH_KEYBOARD;
+    }
 
     WLOG(WS_LOG_DEBUG, "Leaving DoUserAuthInfoRequest(), ret = %d", ret);
 
@@ -10948,11 +10949,11 @@ static int BundlePacket(WOLFSSH* ssh)
 
             idx += paddingSz;
 
-            WMEMSET(output + idx, 0, macSz);
             if (idx + macSz > ssh->outputBuffer.bufferSz) {
                 ret = WS_BUFFER_E;
             }
             else {
+                WMEMSET(output + idx, 0, macSz);
                 ret = CreateMac(ssh, ssh->outputBuffer.buffer +
                         ssh->packetStartIdx, ssh->outputBuffer.length -
                         ssh->packetStartIdx + paddingSz, output + idx);
diff --git a/src/ssh.c b/src/ssh.c
index cf686a7dc..7dad0d568 100644
--- a/src/ssh.c
+++ b/src/ssh.c
@@ -2092,7 +2092,7 @@ int wolfSSH_ReadKey_file(const char* name,
                 out, outSz, outType, outTypeSz, *isPrivate, heap);
     }
 
-    WFCLOSE(ssh->fs, file);
+    WFCLOSE(NULL, file);
     WFREE(in, heap, DYNTYPE_FILE);
 
     return ret;