From 256315fc6aeff5ec985bfee63fae84e6cafc4555 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Tue, 9 Jun 2026 12:20:34 +0000
Subject: Avoid out-of-bounds read in CMS password-based decryption

The RFC 3211 PWRI integrity check when unwrapping the password-derived key
accesses seven bytes from a heap-allocated buffer. If an (invalid) block
cipher with short blocks is in use 2 * blocksize may not be sufficient room
for 7 bytes. In that silly case, the function performs an OOB read. Add
length check to avoid this situation

From Igor Ustinov via OpenSSL.
---
 src/lib/libcrypto/cms/cms_pwri.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/lib/libcrypto/cms/cms_pwri.c b/src/lib/libcrypto/cms/cms_pwri.c
index d282d1d42f..36a53568d1 100644
--- a/src/lib/libcrypto/cms/cms_pwri.c
+++ b/src/lib/libcrypto/cms/cms_pwri.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms_pwri.c,v 1.36 2026/06/09 12:12:34 tb Exp $ */
+/* $OpenBSD: cms_pwri.c,v 1.37 2026/06/09 12:20:34 tb Exp $ */
 /*
  * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
@@ -232,6 +232,10 @@ kek_unwrap_key(unsigned char *out, size_t *outlen, const unsigned char *in,
 	unsigned char *tmp;
 	int outl, rv = 0;
 
+	/* Ensure inlen is large enough that tmp[6] is in bounds. */
+	if (blocklen < 4)
+		return 0;
+
 	if (inlen < 2 * blocklen) {
 		/* too small */
 		return 0;
-- 
cgit v1.2.3-55-g6feb