Issue: Missing Signature Length Validation in ltc_pkcs_1_pss_decode_mgf1 #802

New issue

Open

opened 2026-09-03 01:49:16 -05:00 by headscott · 0 comments

headscott commented

2026-09-03 01:49:16 -05:00

(Migrated from github.com)

ltc_pkcs_1_pss_decode_mgf1 must ensure that siglen is exactly equal to the calculated modulus_len.

Later in the function, (modulus_len - hLen - 1) + hLen = modulus_len - 1 bytes are copied from sig starting at offset 0. Without an explicit length check, a too-short signature can therefore cause an out-of-bounds read.

The signature originates from the peer's certificate and must be treated as untrusted input. While the current caller, rsa_verify_hash_v2, happens to satisfy this requirement through a non-obvious calculation involving modulus_bitlen%8, the validation should be enforced directly in ltc_pkcs_1_pss_decode_mgf1.

Affected Code
src/pk/pkcs1/pkcs_1_pss_decode.c:53

   /* check sizes */
   if ((saltlen > modulus_len) ||
       (modulus_len < hLen + saltlen + 2)) {
      return CRYPT_PK_INVALID_SIZE;
   }

Suggested Fix

   /* check sizes */
   if ((saltlen > modulus_len) ||
       (modulus_len < hLen + saltlen + 2) ||
       (siglen != modulus_len)) {
      return CRYPT_PK_INVALID_SIZE;
   }

`ltc_pkcs_1_pss_decode_mgf1` must ensure that `siglen` is exactly equal to the calculated `modulus_len`. Later in the function, `(modulus_len - hLen - 1) + hLen = modulus_len - 1` bytes are copied from `sig` starting at `offset 0`. Without an explicit length check, a too-short signature can therefore cause an out-of-bounds read. The signature originates from the peer's certificate and must be treated as untrusted input. While the current caller, `rsa_verify_hash_v2`, happens to satisfy this requirement through a non-obvious calculation involving `modulus_bitlen%8`, the validation should be enforced directly in `ltc_pkcs_1_pss_decode_mgf1`. **Affected Code** **src/pk/pkcs1/pkcs_1_pss_decode.c:53** ```c /* check sizes */ if ((saltlen > modulus_len) || (modulus_len < hLen + saltlen + 2)) { return CRYPT_PK_INVALID_SIZE; } ``` **Suggested Fix** ```c /* check sizes */ if ((saltlen > modulus_len) || (modulus_len < hLen + saltlen + 2) || (siglen != modulus_len)) { return CRYPT_PK_INVALID_SIZE; } ```