From f59d50f18a571bfaa3dca87c5d1a09c24c9d22f8 Mon Sep 17 00:00:00 2001
From: Ruby Martin <ruby@wolfssl.com>
Date: Fri, 3 Apr 2026 17:12:27 -0600
Subject: [PATCH] bound notBeforeDataEnd with origSz

---
 tests/api/test_x509.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/api/test_x509.c b/tests/api/test_x509.c
index 47780e6dc4..38bf71f8f6 100644
--- a/tests/api/test_x509.c
+++ b/tests/api/test_x509.c
@@ -502,6 +502,9 @@ static int craft_malicious_time_cert(const byte* orig, int origSz,
 
     notBeforeLenOff = validityOff + 3; /* the 0x0D byte */
     notBeforeDataEnd = notBeforeLenOff + 1 + 13; /* tag(1) was at +2, data starts at +4 */
+    if (notBeforeDataEnd >= origSz) {
+        return -1;
+    }
 
     /* Build the new buffer:
      *   [0 .. notBeforeLenOff-1]  unchanged prefix