From d432759fdd24f38f781c545bf271fd7c88a1b4ad Mon Sep 17 00:00:00 2001
From: Ruby Martin <ruby@wolfssl.com>
Date: Tue, 10 Mar 2026 17:33:32 -0600
Subject: [PATCH] verify algoSz is <= MAX_ALGO_SZ

---
 wolfcrypt/src/asn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index 1f6e75d3f2..8bc8d76605 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -42553,7 +42553,7 @@ int wc_MakeCRL_ex(const byte* issuerDer, word32 issuerSz,
 
     /* Signature AlgorithmIdentifier */
     algoSz = SetAlgoID(sigType, algoBuf, oidSigType, 0);
-    if (algoSz == 0)
+    if (algoSz == 0 || algoSz > MAX_ALGO_SZ)
         return ALGO_ID_E;
 
     /* thisUpdate */