From c006800bd54c1f94a8137bc1fa843a2a1efc7c4f Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 15:14:33 +0200 Subject: [PATCH] libseckey: Fix length check of SPKI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Field spki_size is defined as size_t, so it can never be negative. Before the check, sk_ep11_valid_ep11_blob() ensures that hdr->len is never greater than key_token_length, so the subtraction can never overflow the result, but it still can be zero. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libseckey/sk_ep11.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libseckey/sk_ep11.c b/libseckey/sk_ep11.c index 6ae03aff..119e8f50 100644 --- a/libseckey/sk_ep11.c +++ b/libseckey/sk_ep11.c @@ -561,7 +561,7 @@ int SK_EP11_get_key_type(const unsigned char *key_token, return -EINVAL; spki_size = key_token_length - hdr->len; - if (spki_size <= 0) + if (spki_size == 0) return -EINVAL; rc = sk_ep11_parse_spki(key_token + hdr->len, spki_size, @@ -1381,7 +1381,7 @@ int SK_EP11_get_public_from_secure_key(const unsigned char *key_token, return -EINVAL; spki_size = key_token_length - hdr->len; - if (spki_size <= 0) + if (spki_size == 0) return -EINVAL; rc = sk_ep11_parse_spki(key_token + hdr->len, spki_size,