Validate IV length in the non-streaming path in wc_PKCS7_DecodeEnvelopedData.

Reported by: Jorge Milla (Pig-Tail) <jorge@jmilla.es>
2026-07-08 17:42:38 +02:00 · 2026-07-01 14:32:58 -07:00
parent 6409a9e9a2
commit eb7ebfa222
1 changed files with 6 additions and 0 deletions
@@ -13611,6 +13611,12 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
                break;
            }
        #else
+            /* ensure IV bytes are within the input buffer before copying */
+            if (length < 0 || (word32)length > pkiMsgSz ||
+                    idx > pkiMsgSz - (word32)length) {
+                ret = BUFFER_E;
+                break;
+            }
            ret = 0;
        #endif