[PATCH 2/2] crypto: rsassa-pkcs1: reject undersized keys when verifying

[Jérémy Jean]

rsassa_pkcs1_verify() accepts any nonzero key size.

With a one-byte key and a zero RSA result, the leading-zero handling
decrements dst_len to zero and advances out_buf past the allocation.
The next out_buf[0] access reads out of bounds.

KASAN reports:

    BUG: KASAN: slab-out-of-bounds in rsassa_pkcs1_verify+0x79d/0x900
    Read of size 1 at addr ...
    The buggy address is located 0 bytes to the right of
     allocated 73-byte region [...]

Reject keys shorter than the minimum PKCS#1 v1.5 encoded message size.

Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---
 crypto/rsassa-pkcs1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/rsassa-pkcs1.c b/crypto/rsassa-pkcs1.c
index d0e4a885397f..39137476ce81 100644
--- a/crypto/rsassa-pkcs1.c
+++ b/crypto/rsassa-pkcs1.c
@@ -231,7 +231,7 @@ static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
 	int err;
 
 	/* RFC 8017 sec 8.2.2 step 1 - length checking */
-	if (!ctx->key_size ||
+	if (ctx->key_size < 11 ||
 	    slen != ctx->key_size ||
 	    rsassa_pkcs1_invalid_hash_len(dlen, hash_prefix))
 		return -EINVAL;
-- 
2.47.3