Fix ReqCertFromX509 to check bounds

[embhorn]

Description

In ReqCertFromX509, add a check on SKID size

Fixes zd21567

Testing

Added test_x509_ReqCertFromX509_skid_overflow

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR hardens CSR/certificate copying logic by adding a bounds check for SubjectKeyIdentifier (SKID) size in wolfSSL_sk_X509_OBJECT_deep_copy, and introduces a regression test to ensure oversized SKID data is rejected.

Changes:

• Add CTC_MAX_SKID_SIZE bounds checking before copying SKID into cert->skid.
• Add a new API test covering a crafted CSR with an oversized SKID extension.
• Update wolfssl/version.h version macros (currently appears to be a downgrade).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
wolfssl/version.h	Adjusts library version macros (doesn’t align with the stated purpose of this PR).
tests/api/test_x509.h	Declares/registers the new SKID overflow regression test.
tests/api/test_x509.c	Adds a crafted-DER regression test for oversized SKID handling.
src/x509.c	Adds SKID size bounds checking to prevent buffer overflow during deep copy.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[embhorn]

Jenkins retest this please

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.