From 7d56dde24a9f96802c94bf386eb09ff0a93c329e Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 13:21:48 +0200 Subject: [PATCH] libkmipclient: Fix size underflow when padding bytes exceed remaining size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When decoding a value that is exactly at the boundary of the available size (i.e., *size == value_len), and the value length is not a multiple of the TTLV block length, then *size wraps to a huge value when the pad_len is subtracted. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libkmipclient/ttlv.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libkmipclient/ttlv.c b/libkmipclient/ttlv.c index b7d04dad..e528297d 100644 --- a/libkmipclient/ttlv.c +++ b/libkmipclient/ttlv.c @@ -166,8 +166,15 @@ int kmip_decode_ttlv(BIO *bio, size_t *size, struct kmip_node **node, rc = -EIO; goto out; } - if (size != NULL) + + if (size != NULL) { + if (*size < pad_len) { + rc = -EMSGSIZE; + goto out; + } + *size -= pad_len; + } } switch (n->type) {