JNI reference, resource, and error-handling fixes

[cconlon]

This PR includes 4 Fenrir fixes:

• F-11872: NativeVerifyCallback deletes the JNI local references it creates each invocation, so they no longer accumulate across a certificate chain.
• F-11877: WolfCrypt ECC/RSA verify and decrypt helpers check the key init result before operating on or freeing the key.
• F-11878: newSSL() checks each mutex init result and frees initialized mutexes on its construction rollback paths.
• F-11884: sessionToDer() and setSessTimeout() release the owned getSession() reference via try/finally.

[Copilot]

Pull request overview

This PR tightens JNI/native resource lifetime management in wolfssljni by ensuring references, mutexes, and cryptographic key structures are properly initialized and released on both success and rollback/error paths.

Changes:

• Ensure getSession() “owned” session references are released via try/finally in setSessTimeout() and sessionToDer().
• Add mutex init result checks in newSSL() and perform orderly cleanup of already-initialized resources on failure paths.
• Prevent JNI local reference accumulation in NativeVerifyCallback by explicitly deleting local refs each invocation.
• Validate ECC/RSA key init results before use/free to avoid operating on uninitialized structures.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/java/com/wolfssl/WolfSSLSession.java	Uses try/finally to always release getSession()-owned references in updated call sites.
native/com_wolfssl_WolfSSLSession.c	Checks mutex init return values and frees mutexes/resources on rollback paths in newSSL().
native/com_wolfssl_WolfSSLContext.c	Adds helper to delete JNI local refs created during NativeVerifyCallback to prevent local-ref buildup.
native/com_wolfssl_WolfCryptRSA.c	Checks wc_InitRsaKey() result before decode/verify/decrypt logic runs.
native/com_wolfssl_WolfCryptECC.c	Checks wc_ecc_init() result before importing/verifying with the ECC key.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.