Guard AEAD buffer growth overflow

danielinux · danielinux · commit 7d6b0ac006c9 · 2026-03-10T17:58:11.000+01:00
F/007
diff --git a/src/psa_aead.c b/src/psa_aead.c
@@ -72,6 +72,9 @@ static psa_status_t wolfpsa_aead_append(uint8_t **buf, size_t *len,
     if (data_length == 0) {
         return PSA_SUCCESS;
     }
+    if (*len > SIZE_MAX - data_length) {
+        return PSA_ERROR_INSUFFICIENT_MEMORY;
+    }
 
     new_buf = (uint8_t *)XMALLOC(*len + data_length, NULL,
                                  DYNAMIC_TYPE_TMP_BUFFER);

Original file line number	Diff line number	Diff line change
`@@ -72,6 +72,9 @@ static psa_status_t wolfpsa_aead_append(uint8_t *buf, size_t len,`
`72`	`72`	`if (data_length == 0) {`
`73`	`73`	`return PSA_SUCCESS;`
`74`	`74`	`}`
	`75`	`+ if (*len > SIZE_MAX - data_length) {`
	`76`	`+ return PSA_ERROR_INSUFFICIENT_MEMORY;`
	`77`	`+ }`
`75`	`78`
`76`	`79`	`new_buf = (uint8_t )XMALLOC(len + data_length, NULL,`
`77`	`80`	`DYNAMIC_TYPE_TMP_BUFFER);`