From aa7b2683765455dee147d927efceebbb7d404db2 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Fri, 10 Jul 2026 12:06:23 -0700 Subject: [PATCH] F-4795 - Guard ClientPublicKeyCheck against short public key blob --- apps/wolfssh/common.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/apps/wolfssh/common.c b/apps/wolfssh/common.c index ac1adc4e..2d6e7693 100644 --- a/apps/wolfssh/common.c +++ b/apps/wolfssh/common.c @@ -392,11 +392,16 @@ int ClientPublicKeyCheck(const byte* pubKey, word32 pubKeySz, void* ctx) fp[0] = 0; /* Get the key type out of the key. */ - ato32(pubKey, &sz); - if ((sz > pubKeySz - sizeof(word32)) - || (sz > WOLFSSH_CLIENT_PUBKEYTYPE_SIZE_ESTIMATE - 1)) { + if (pubKeySz < sizeof(word32)) { ret = -1; } + else { + ato32(pubKey, &sz); + if ((sz > pubKeySz - sizeof(word32)) + || (sz > WOLFSSH_CLIENT_PUBKEYTYPE_SIZE_ESTIMATE - 1)) { + ret = -1; + } + } } if (ret == 0) {