Fix integer overflow in ParseRFC6187 name length

- Reject name lengths that would overflow m when added
  to sizeof(word32), preventing OOB reads on later checks.

Issue: F-1277
pull/977/head
John Safranek 2026-05-12 10:52:14 -07:00 committed by Paul Adelsbach
parent 11e407f7db
commit 822c09d0eb
1 changed files with 3 additions and 0 deletions

View File

@ -144,6 +144,9 @@ static int ParseRFC6187(const byte* in, word32 inSz, byte** leafOut,
/* Skip the name */
ato32(in, &l);
if (l > inSz - sizeof(word32))
return WS_BUFFER_E;
m += l + sizeof(word32);
/* Get the cert count */