From 927f901969f09ca12b04a1f9a9ea098d0a3a9a0e Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 16:24:33 +0200 Subject: [PATCH] libekmfweb: Fix size check of the response party info MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The party info contained in the response might be of an arbitrary size. Check for an overflow before allocating the party info buffer for the combined request and response party info data. With a very large response party info size, the combined size might overflow (i.e. wrap around), causing a too small buffer being allocated and the following memcpy's would cause an out of bounds write. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libekmfweb/ekmfweb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libekmfweb/ekmfweb.c b/libekmfweb/ekmfweb.c index 7d880633..ad31ab55 100644 --- a/libekmfweb/ekmfweb.c +++ b/libekmfweb/ekmfweb.c @@ -2220,6 +2220,11 @@ static int _ekmf_import_key(unsigned char *req_sess_key, unsigned char *party_info = NULL; int rc; + if (resp_party_info_length > SIZE_MAX - req_party_info_length) { + rc = -EINVAL; + goto out; + } + party_info_length = req_party_info_length + resp_party_info_length; party_info = malloc(party_info_length); if (party_info == NULL) {