From 3ea90a2258f60dc86e57d43e73dd676ce1d529a3 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 13:33:11 +0200 Subject: [PATCH] libkmipclient: Fix integer overflow with large value length MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Limit the value_len to not be larger than INT_MAX, because later on BIO_read() is called with value_len and it uses the int type for length parameter and return value. This check also prevents the 'value_len + 1' from overflow, because value_len is a size_t and this accepts larger values than int (even on 32 bit architectures). Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libkmipclient/ttlv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libkmipclient/ttlv.c b/libkmipclient/ttlv.c index e528297d..7d1dacde 100644 --- a/libkmipclient/ttlv.c +++ b/libkmipclient/ttlv.c @@ -104,6 +104,11 @@ int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node, case KMIP_TYPE_TEXT_STRING: case KMIP_TYPE_BYTE_STRING: value_len = n->length; + if (value_len > INT_MAX) { + rc = -EMSGSIZE; + goto out; + } + value = calloc(1, value_len + 1); if (value == NULL) { kmip_debug(debug, "calloc failed");