From eb7ebfa22270e9c3e24a69b6eda1bb12979f5e68 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Wed, 1 Jul 2026 14:32:58 -0700
Subject: [PATCH] Validate IV length in the non-streaming path in
 wc_PKCS7_DecodeEnvelopedData.

Reported by: Jorge Milla (Pig-Tail) <jorge@jmilla.es>
---
 wolfcrypt/src/pkcs7.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 0a84f23cad..52083afe77 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -13611,6 +13611,12 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
                 break;
             }
         #else
+            /* ensure IV bytes are within the input buffer before copying */
+            if (length < 0 || (word32)length > pkiMsgSz ||
+                    idx > pkiMsgSz - (word32)length) {
+                ret = BUFFER_E;
+                break;
+            }
             ret = 0;
         #endif