[ejohnstown]

Every echoserver_test() failure goes through one cleanup label that
frees what is set up so far, so the in-process test harness no longer
leaks on a startup error.

• usage errors keep MY_EX_USAGE
• api: usage, algo-list and key-load failures run under LSan

Issue: F-17053

[Copilot]

🟡 Changes recommended

The mutex initialization return value is unchecked, so a failed initialization still sets doneLockInit and can cause startup error cleanup to free an uninitialized mutex.

1 open issue

• Check mutex initialization before marking it initialized · New

What changed in this PR

This PR routes echoserver_test() failures through a shared cleanup path to prevent resource leaks in the in-process test harness.

Changes:

• Tracks initialization and releases resources on failure while preserving MY_EX_USAGE for usage errors.
• Frees connection resources before unwinding selected setup failures.
• Adds API tests for usage, algorithm-list, and key-load failures, intended to run under a leak checker.

File	Description
tests/​api.c	Adds startup-failure cleanup regression tests.
examples/​echoserver/​echoserver.c	Centralizes failure cleanup and tracks initialized resources.

_{Review effort: Balanced}

[ejohnstown]

@claude review

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1379

Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[claude]

LGTM. The single cleanup label in echoserver_test() is correct and doesn't double-free anything along any of the paths I traced.

What was reviewed:

• Every ES_ERROR path, from the usage error through the accept loop. Each one jumps to echoserverFail with the state it needs already set: pwMapList and kbAuthData are zeroed on entry, ctx/listenFd start as NULL/invalid, and the mutex and wolfSSH_Init are guarded by flags.
• Double frees ruled out. The option lists are set to NULL after they're consumed, the old inline prompt and cert-store frees are gone, and the paths that still free keyLoadBuf, or ssh and threadCtx, do so only before the jump.
• Freeing ctx from inside the accept loop is safe because server_worker runs inline, not on a separate thread. EchoserverCleanupTpmHostKey does nothing when no TPM key was loaded, and calling wolfSSH_Cleanup from the test is balanced because wolfCrypt_Init is reference-counted.

Extended reasoning...

The change touches only the example echoserver (examples/echoserver/echoserver.c) and adds an API test (tests/api.c). It doesn't change any library code or any security-sensitive surface such as auth or crypto logic. It moves echoserver_test()'s error handling to a single goto-based cleanup label, and every resource it frees there is either initialized up front or guarded by a flag. The only earlier inline comment, from an automated reviewer at the wc_InitMutex line, was followed by a commit that now checks that call's return value. The bug hunt ran to completion (dry_streak) with no findings.