mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-17 16:21:34 +02:00
The DigestInfo length extraction in wc_SignatureVerifyHash was compiled only when WOLFSSL_RSA_PUBLIC_ONLY was not defined, but the block depends on ASN.1 support, not on private key support. In a public only build the RSA verify path stays reachable and wc_SignatureVerify still DER encodes the digest, so the length check fell through to the plain digest size comparison and rejected every valid signature with BAD_LENGTH_E. The same guard also broke compilation with NO_ASN and RSA enabled, since asn.h is not included in that case and GetSequence and GetOctetString are undeclared. Guard the block on NO_ASN instead, matching the DER encode call site in wc_SignatureVerify. Fixes F-7412.