From 85afcedf28d88d66c286a36e2e7d57534bac9630 Mon Sep 17 00:00:00 2001 From: Loganaden Velvindron Date: Wed, 10 Jun 2026 12:37:42 +0400 Subject: [PATCH] Validate signature length to prevent OOB read Signed-off-by: Loganaden Velvindron --- slh_dsa.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/slh_dsa.c b/slh_dsa.c index 4fb3dad..1d48fde 100644 --- a/slh_dsa.c +++ b/slh_dsa.c @@ -688,6 +688,10 @@ int slh_verify_internal(const uint8_t *m, size_t m_sz, const uint8_t *sig, slh_var_t var; uint8_t digest[SLH_MAX_M]; + if (sig_sz != slh_sig_sz(prm)) + { + return 0; /* false */ + } /* use Hmsg directly */ prm->mk_var(&var, pk, NULL, prm); prm->h_msg(&var, digest, sig, m, m_sz, NULL, SLH_CTX_SZ_NO_CONTEXT); @@ -710,6 +714,11 @@ int slh_verify(const uint8_t *m, size_t m_sz, const uint8_t *sig, size_t sig_sz, return 0; /* false */ } + if (sig_sz != slh_sig_sz(prm)) + { + return 0; /* false */ + } + /* create the "pure" hash (with context) */ prm->mk_var(&var, pk, NULL, prm); prm->h_msg(&var, digest, sig, m, m_sz, ctx, ctx_sz);