Sanity check keylength in PVK files.

PR#2277
(cherry picked from commit 733a6c882e92f8221bd03a51643bb47f5f81bb81)

diff --git a/crypto/pem/pvkfmt.c b/crypto/pem/pvkfmt.c
index b1bf71a5daad4ce62e8365d167bde8ad5a4f37d0..ae89f8281a827fa27cd90d99bee7de2beebc33f4 100644 (file)
--- a/crypto/pem/pvkfmt.c
+++ b/crypto/pem/pvkfmt.c
@@ -759,6 +759,11 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in,
                /* Copy BLOBHEADER across, decrypt rest */
                memcpy(enctmp, p, 8);
                p += 8;
+               if (keylen < 8)
+                       {
+                       PEMerr(PEM_F_DO_PVK_BODY, PEM_R_PVK_TOO_SHORT);
+                       return NULL;
+                       }
                inlen = keylen - 8;
                q = enctmp + 8;
                if (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))