From 6cda35442f901a84d55ff1fcb9f89855f468f26b Mon Sep 17 00:00:00 2001 From: Benjamin Beurdouche Date: Mon, 27 Jul 2026 19:05:33 +0200 Subject: [PATCH] Bug 2027346 - validate encoded EC params length and tag in SECKEY_ECParamsToKeySize/BasePointOrderLen. --- security/nss/lib/cryptohi/seckey.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/nss/lib/cryptohi/seckey.c b/security/nss/lib/cryptohi/seckey.c index 656609e0d2..9a43d6d69a 100644 --- a/security/nss/lib/cryptohi/seckey.c +++ b/security/nss/lib/cryptohi/seckey.c @@ -696,6 +696,13 @@ SECKEY_ECParamsToKeySize(const SECItem *encodedParams) /* The encodedParams data contains 0x06 (SEC_ASN1_OBJECT_ID), * followed by the length of the curve oid and the curve oid. */ + if (!encodedParams || !encodedParams->data || + encodedParams->len < 2 || + encodedParams->data[0] != SEC_ASN1_OBJECT_ID || + (unsigned)encodedParams->data[1] > encodedParams->len - 2) { + PORT_SetError(SEC_ERROR_BAD_DER); + return 0; + } oid.len = encodedParams->data[1]; oid.data = encodedParams->data + 2; if ((tag = SECOID_FindOIDTag(&oid)) == SEC_OID_UNKNOWN)