From 220f51fb98713235e0048f19f85bc8d0c3dc928d Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 15:47:14 +0200 Subject: [PATCH] libseckey: Fix integer underflow for malformed SPKIs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the BER encoded BITRSTRING field has a zero length, then skipping the unused-bits byte that a BITRSTING normally contains will cause a underflow and thus may cause an out of bounds read by the caller of sk_ep11_parse_spki(). Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libseckey/sk_ep11.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libseckey/sk_ep11.c b/libseckey/sk_ep11.c index 6fd1fbe6..0b7c430f 100644 --- a/libseckey/sk_ep11.c +++ b/libseckey/sk_ep11.c @@ -504,6 +504,8 @@ static int sk_ep11_parse_spki(const unsigned char *spki, size_t spki_len, pub_key, pub_key_len); if (tag != 0x03) /* BITSTRING */ return -EINVAL; + if (*pub_key_len == 0) + return -EINVAL; /* skip unsused-bits byte */ (*pub_key)++;