fixes

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

Author: sameehj

wolfcrypt/src/pkcs7.c

@@ -1180,54 +1180,25 @@ int wc_PKCS7_InitWithCert(wc_PKCS7* pkcs7, byte* derCert, word32 derCertSz)
         }
 
         /* verify extracted public key is valid before storing */
-#ifndef WC_RSA_PSS
         ret = wc_PKCS7_CheckPublicKeyDer(pkcs7, (int)dCert->keyOID,
                                          dCert->publicKey, dCert->pubKeySize);
-#else
-        /* For RSAPSSk, cert parser may store key in a form that fails
-         * wc_RsaPublicKeyDecode; skip decode check and rely on size/copy below */
-        if (dCert->keyOID != RSAPSSk)
-            ret = wc_PKCS7_CheckPublicKeyDer(pkcs7, (int)dCert->keyOID,
-                                             dCert->publicKey, dCert->pubKeySize);
-#endif
         if (ret != 0) {
             WOLFSSL_MSG("Invalid public key, check pkcs7->cert");
             FreeDecodedCert(dCert);
             WC_FREE_VAR_EX(dCert, pkcs7->heap, DYNAMIC_TYPE_DCERT);
             return ret;
         }
 
-        if (dCert->serialSz > MAX_SN_SZ) {
-            WOLFSSL_MSG("Invalid size in certificate");
-            FreeDecodedCert(dCert);
-            WC_FREE_VAR_EX(dCert, pkcs7->heap, DYNAMIC_TYPE_DCERT);
-            return ASN_PARSE_E;
-        }
-#ifdef WC_RSA_PSS
-        if (dCert->keyOID != RSAPSSk &&
-            dCert->pubKeySize > (MAX_RSA_INT_SZ + MAX_RSA_E_SZ)) {
-            WOLFSSL_MSG("Invalid size in certificate");
-            FreeDecodedCert(dCert);
-            WC_FREE_VAR_EX(dCert, pkcs7->heap, DYNAMIC_TYPE_DCERT);
-            return ASN_PARSE_E;
-        }
-#else
-        if (dCert->pubKeySize > (MAX_RSA_INT_SZ + MAX_RSA_E_SZ)) {
+        if (dCert->pubKeySize > (MAX_RSA_INT_SZ + MAX_RSA_E_SZ) ||
+            dCert->serialSz > MAX_SN_SZ) {
             WOLFSSL_MSG("Invalid size in certificate");
             FreeDecodedCert(dCert);
             WC_FREE_VAR_EX(dCert, pkcs7->heap, DYNAMIC_TYPE_DCERT);
             return ASN_PARSE_E;
         }
-#endif
 
-        /* For RSAPSSk, cert parser may report larger pubKeySize; copy only what fits */
-        {
-            word32 copySz = dCert->pubKeySize;
-            if (copySz > (MAX_RSA_INT_SZ + MAX_RSA_E_SZ))
-                copySz = (MAX_RSA_INT_SZ + MAX_RSA_E_SZ);
-            XMEMCPY(pkcs7->publicKey, dCert->publicKey, copySz);
-            pkcs7->publicKeySz = copySz;
-        }
+        XMEMCPY(pkcs7->publicKey, dCert->publicKey, dCert->pubKeySize);
+        pkcs7->publicKeySz = dCert->pubKeySize;
         pkcs7->publicKeyOID = dCert->keyOID;
         /* Do not derive publicKeyOID from cert signatureOID: the cert's
          * signature is how the cert was signed by its issuer; the signer
@@ -5507,10 +5478,13 @@ static int wc_PKCS7_ParseSignerInfo(wc_PKCS7* pkcs7, byte* in, word32 inSz,
 #if defined(WC_RSA_PSS) && !defined(NO_RSA)
                         if ((word32)sigOID == (word32)CTC_RSASSAPSS &&
                             paramTag == (ASN_SEQUENCE | ASN_CONSTRUCTED)) {
-                            word32 tlvLen = (word32)((int)idx - (int)paramsStart) +
+                            word32 tlvLen = (idx - paramsStart) +
                                             (word32)paramLen;
                             enum wc_HashType pssHash = WC_HASH_TYPE_SHA;
                             int pssMgfVal = 0, pssSalt = 0;
+                            if (paramsStart + tlvLen > (word32)inSz) {
+                                return ASN_PARSE_E;
+                            }
                             ret = wc_DecodeRsaPssParams(in + paramsStart, tlvLen,
                                                         &pssHash, &pssMgfVal,
                                                         &pssSalt);
@@ -5520,7 +5494,6 @@ static int wc_PKCS7_ParseSignerInfo(wc_PKCS7* pkcs7, byte* in, word32 inSz,
                                 pkcs7->pssMgf = pssMgfVal;
                             }
                             else {
-                                /* Missing or unsupported PSS params: fail parse per RFC 4055 */
                                 WOLFSSL_MSG("RSASSA-PSS parameters invalid - failing parse");
                                 return ASN_PARSE_E;
                             }