From e7a9f622ffc313e3f18c6382b141a113d5634f14 Mon Sep 17 00:00:00 2001
From: Levi Neely <lkn@darkstar.example.net>
Date: Tue, 3 Mar 2026 15:32:57 +0100
Subject: [PATCH] Add bounds check in trim_der_key() before memcpy

Verify correct_len <= *keylen before reading from keydata buffer.
Log error and return if ASN.1 length exceeds actual buffer size.

Fixes #237
---
 pclsync/pssl.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pclsync/pssl.c b/pclsync/pssl.c
index 1a7a638..b05b71a 100644
--- a/pclsync/pssl.c
+++ b/pclsync/pssl.c
@@ -620,6 +620,13 @@ static void trim_der_key(unsigned char *keydata, size_t *keylen) {
     }
     header_size = p - keydata;
     correct_len = header_size + len;
+    if (correct_len > *keylen) {
+        pdbg_logf(D_ERROR, "ASN.1 length %zu exceeds buffer size %zu", correct_len, *keylen);
+        return;
+    }
+    if (correct_len > *keylen) {
+        return;
+    }
     trimmed = malloc(correct_len);
     if (!trimmed) return;
     memcpy(trimmed, keydata, correct_len);