Commit d078067a26 for openssl.org

commit d078067a26422aa1a1ce5a4cdba0d0da69f8ff1e
Author: Abel Thomas <abeltom.kernel@gmail.com>
Date:   Wed Aug 19 13:53:37 2026 +0200

    file_store_any2obj.c: validate blob length before allocation

    Both msblob2obj_decode() and pvk2obj_decode() computed an
    attacker-influenced buffer size (from `bitlen`, or from
    `saltlen + keylen`) and passed it to BUF_MEM_grow() without an
    upper bound.

    Resolves #31684

    Fixes: f40c5f2c53b9 "PROV & STORE: Make the 'file:' store loader understand more binary formats"
    Fixes: 0f5493e60b9e "storemgmt: Validate msblob length before buffer allocation"
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Merge-date: Fri Aug 21 10:09:11 2026
    Merged-from: https://github.com/openssl/openssl/pull/31704

diff --git a/providers/implementations/storemgmt/file_store_any2obj.c b/providers/implementations/storemgmt/file_store_any2obj.c
index 8409c17881..17eebfb025 100644
--- a/providers/implementations/storemgmt/file_store_any2obj.c
+++ b/providers/implementations/storemgmt/file_store_any2obj.c
@@ -194,11 +194,9 @@ static int msblob2obj_decode(void *vctx, OSSL_CORE_BIO *cin, int selection,
     ok = 0;
     mem_want = ossl_blob_length(bitlen, isdss, ispub);

-    if (bitlen > BLOB_MAX_LENGTH) {
-        ERR_raise(ERR_LIB_PEM, PEM_R_HEADER_TOO_LONG);
-        goto err;
+    if (mem_want > BLOB_MAX_LENGTH) {
+        goto next;
     }
-
     if (!BUF_MEM_grow(mem, mem_len + mem_want)) {
         ERR_raise(ERR_LIB_PEM, ERR_R_BUF_LIB);
         goto err;