From 822c09d0ebd88db1b72ee6294998ae6e3006907a Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 12 May 2026 10:52:14 -0700
Subject: [PATCH] Fix integer overflow in ParseRFC6187 name length

- Reject name lengths that would overflow m when added
  to sizeof(word32), preventing OOB reads on later checks.

Issue: F-1277
---
 apps/wolfssh/common.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/wolfssh/common.c b/apps/wolfssh/common.c
index 8eb2c605..03b4ac63 100644
--- a/apps/wolfssh/common.c
+++ b/apps/wolfssh/common.c
@@ -144,6 +144,9 @@ static int ParseRFC6187(const byte* in, word32 inSz, byte** leafOut,
 
     /* Skip the name */
     ato32(in, &l);
+    if (l > inSz - sizeof(word32))
+        return WS_BUFFER_E;
+
     m += l + sizeof(word32);
 
     /* Get the cert count */