From b1a6f86298af7dfbaa1110b86662a9d1393a7678 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Tue, 25 Nov 2025 15:58:02 +0100 Subject: [PATCH] pkcs15: Avoid buffer overrun on invalid data Invalid data can contain zero-length buffer, which after copying was dereferenced without length check Credit: Aldo Ristori Signed-off-by: Jakub Jelen (cherry picked from commit 65fc211015cfcac27b10d0876054156c97225f50) CVE: CVE-2025-66037 Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/65fc211015cfcac27b10d0876054156c97225f50] Signed-off-by: Ankur Tyagi --- src/libopensc/pkcs15-pubkey.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/libopensc/pkcs15-pubkey.c b/src/libopensc/pkcs15-pubkey.c index a759efa45..48fb08cac 100644 --- a/src/libopensc/pkcs15-pubkey.c +++ b/src/libopensc/pkcs15-pubkey.c @@ -1328,6 +1328,10 @@ sc_pkcs15_pubkey_from_spki_fields(struct sc_context *ctx, struct sc_pkcs15_pubke "sc_pkcs15_pubkey_from_spki_fields() called: %p:%"SC_FORMAT_LEN_SIZE_T"u\n%s", buf, buflen, sc_dump_hex(buf, buflen)); + if (buflen < 1) { + LOG_TEST_RET(ctx, SC_ERROR_INVALID_DATA, "subjectPublicKeyInfo can not be empty"); + } + tmp_buf = malloc(buflen); if (!tmp_buf) { r = SC_ERROR_OUT_OF_MEMORY;