From 636cb34bd798c6f2957313df2ce270908b463d3f Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Wed, 22 Jul 2026 16:28:50 -0700
Subject: [PATCH] Code review feedback

---
 src/tls.c                | 12 +++++++-----
 tests/api/test_tls_ext.c | 25 ++++++++++++++-----------
 2 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/src/tls.c b/src/tls.c
index 3c2ccb344a..dcfc05c01b 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -18959,13 +18959,15 @@ WOLFSSL_TEST_VIS int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
                 if (size != 0)
                     return BUFFER_ERROR;
 
+                /* Honor a user request to disable EMS by ignoring the peer's
+                 * extension rather than enabling it. */
+                if (!ssl->options.disableEMS) {
 #ifndef NO_WOLFSSL_SERVER
-                /* Honor a user request to disable EMS on the server by
-                 * ignoring the peer's extension rather than enabling it. */
-                if (isRequest && !ssl->options.disableEMS)
-                    ssl->options.haveEMS = 1;
+                    if (isRequest)
+                        ssl->options.haveEMS = 1;
 #endif
-                pendingEMS = 1;
+                    pendingEMS = 1;
+                }
                 break;
 #endif
 
diff --git a/tests/api/test_tls_ext.c b/tests/api/test_tls_ext.c
index 9e1846cba0..4bcae3b6be 100644
--- a/tests/api/test_tls_ext.c
+++ b/tests/api/test_tls_ext.c
@@ -369,6 +369,7 @@ static int test_tls_require_ems_ex(int serverSide, int peerDisables)
     WOLFSSL_CTX *ctx_s = NULL;
     WOLFSSL *ssl_c = NULL;
     WOLFSSL *ssl_s = NULL;
+    int ret;
 
     XMEMSET(&test_ctx, 0, sizeof(test_ctx));
 
@@ -389,12 +390,13 @@ static int test_tls_require_ems_ex(int serverSide, int peerDisables)
                     WOLFSSL_SUCCESS);
 
         /* EMS cannot be negotiated so the requiring side must abort. */
-        ExpectIntNE(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
+        ret = test_memio_do_handshake(ssl_c, ssl_s, 10, NULL);
+        ExpectIntNE(ret, 0);
         if (serverSide)
-            ExpectIntEQ(wolfSSL_get_error(ssl_s, 0),
+            ExpectIntEQ(wolfSSL_get_error(ssl_s, ret),
                     WC_NO_ERR_TRACE(EXT_MASTER_SECRET_NEEDED_E));
         else
-            ExpectIntEQ(wolfSSL_get_error(ssl_c, 0),
+            ExpectIntEQ(wolfSSL_get_error(ssl_c, ret),
                     WC_NO_ERR_TRACE(EXT_MASTER_SECRET_NEEDED_E));
     }
     else {
@@ -980,11 +982,11 @@ int test_wolfSSL_DisableExtendedMasterSecret(void)
     EXPECT_DECLS;
 #if defined(HAVE_EXTENDED_MASTER) && !defined(NO_WOLFSSL_CLIENT) && \
     !defined(NO_TLS)
-    WOLFSSL_CTX *ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
-    WOLFSSL     *ssl = wolfSSL_new(ctx);
+    WOLFSSL_CTX *ctx = NULL;
+    WOLFSSL     *ssl = NULL;
 
-    ExpectNotNull(ctx);
-    ExpectNotNull(ssl);
+    ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));
+    ExpectNotNull(ssl = wolfSSL_new(ctx));
 
     /* error cases */
     ExpectIntNE(WOLFSSL_SUCCESS, wolfSSL_CTX_DisableExtendedMasterSecret(NULL));
@@ -1006,11 +1008,12 @@ int test_wolfSSL_DisableNormalMasterSecret(void)
     EXPECT_DECLS;
 #if defined(HAVE_EXTENDED_MASTER) && !defined(NO_WOLFSSL_CLIENT) && \
     !defined(NO_TLS)
-    WOLFSSL_CTX *ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
-    WOLFSSL     *ssl = wolfSSL_new(ctx);
+    WOLFSSL_CTX *ctx = NULL;
+    WOLFSSL     *ssl = NULL;
 
-    ExpectNotNull(ctx);
-    ExpectNotNull(ssl);
+
+    ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));
+    ExpectNotNull(ssl = wolfSSL_new(ctx));
 
     /* error cases */
     ExpectIntNE(WOLFSSL_SUCCESS, wolfSSL_CTX_DisableNormalMasterSecret(NULL));