From a5b09c73c67d5510392533bba209e55e9e24f6b1 Mon Sep 17 00:00:00 2001
From: Levi Neely <141506390+lneely@users.noreply.github.com>
Date: Tue, 3 Mar 2026 15:51:54 +0100
Subject: [PATCH] Add upper bound check in check_peer_pubkey() (#323)

Daemon tested, TLS works, crypto folder works
---
 pclsync/pssl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pclsync/pssl.c b/pclsync/pssl.c
index 1a7a638..d95090d 100644
--- a/pclsync/pssl.c
+++ b/pclsync/pssl.c
@@ -304,8 +304,9 @@ static int check_peer_pubkey(ssl_connection_t *conn) {
   }
   i = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *)&cert->pk, buff,
                                   sizeof(buff));
-  if (i <= 0) {
-    pdbg_logf(D_WARNING, "pk_write_pubkey_der returned error %d", i);
+  if (i <= 0 || i > (int)sizeof(buff)) {
+    pdbg_logf(D_WARNING, "pk_write_pubkey_der returned %d (buffer size %zu)", 
+              i, sizeof(buff));
     return -1;
   }
   mbedtls_sha256(buff + sizeof(buff) - i, i, sigbin, 0);