From 7aec2a8280920a3380a4cd8ef254974bfb167477 Mon Sep 17 00:00:00 2001
From: Ruby Martin <ruby@wolfssl.com>
Date: Tue, 28 Oct 2025 10:01:10 -0600
Subject: [PATCH] separate BAD_FUNC_ARG error from ASN_NO_PEM_HEADER

---
 src/x509.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/x509.c b/src/x509.c
index 17a5ac2dd..f5b0196b2 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -12368,7 +12368,14 @@ WOLFSSL_X509_CRL* wolfSSL_PEM_read_X509_CRL(XFILE fp,
             return WOLFSSL_FAILURE;
         }
 
-        if ((l = wolfSSL_BIO_get_len(bio)) <= pem_struct_min_sz) {
+        l = wolfSSL_BIO_get_len(bio);
+
+        if (l < 0) {
+            WOLFSSL_ERROR(BAD_FUNC_ARG);
+            return WOLFSSL_FAILURE;
+        }
+
+        if (l <= pem_struct_min_sz) {
             /* No certificate in buffer */
             WOLFSSL_ERROR(ASN_NO_PEM_HEADER);
             return WOLFSSL_FAILURE;