From 64aa73e65e6622c6382babb9c60fb6b98a131a3e Mon Sep 17 00:00:00 2001
From: Colton Willey <colton@wolfssl.com>
Date: Mon, 27 Jul 2026 14:41:28 -0700
Subject: [PATCH] F-4935 - Guard word32 length overflow in wp_read_pem_bio

Port the UINT32_MAX bound already present in wp_read_der_bio. Honor a
failed read in wp_pem2der_decode instead of decoding a partial buffer.
Use WP_FITS_WORD32 in both guards and fix %d used for long readLen.
---
 src/wp_dec_pem2der.c |  2 +-
 src/wp_internal.c    | 20 +++++++++++++++-----
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/src/wp_dec_pem2der.c b/src/wp_dec_pem2der.c
index 745edf93..c2f46f43 100644
--- a/src/wp_dec_pem2der.c
+++ b/src/wp_dec_pem2der.c
@@ -441,7 +441,7 @@ static int wp_pem2der_decode(wp_Pem2Der* ctx, OSSL_CORE_BIO* coreBio,
     else if (data == NULL) {
         done = 1;
     }
-    if (!done) {
+    if (ok && !done) {
         idx += wp_pem2der_find_header(data + idx, len - idx);
         /* No header means nothing to do. */
         if (idx == len) {
diff --git a/src/wp_internal.c b/src/wp_internal.c
index 6dc3a171..cd4df24b 100644
--- a/src/wp_internal.c
+++ b/src/wp_internal.c
@@ -1276,18 +1276,21 @@ int wp_read_der_bio(WOLFPROV_CTX *provctx, OSSL_CORE_BIO *coreBio, unsigned char
     while (ok && (readLen > 0)) {
         readLen = BIO_read(bio, buf, sizeof(buf));
         if (readLen < -1) {
-            WOLFPROV_MSG(WP_LOG_COMP_PROVIDER, "BIO_read error (%d) in %s:%d", readLen, __FILE__, __LINE__);
+            WOLFPROV_MSG(WP_LOG_COMP_PROVIDER, "BIO_read error (%ld) in %s:%d", readLen, __FILE__, __LINE__);
             ok = 0;
         }
         if (ok && (readLen > 0) &&
-                ((uint64_t)*len + (uint64_t)readLen > (uint64_t)UINT32_MAX)) {
+                (!WP_FITS_WORD32((uint64_t)*len + (uint64_t)readLen))) {
+            WOLFPROV_MSG(WP_LOG_COMP_PROVIDER,
+                "Length overflow (%u + %ld) in %s:%d", *len, readLen, __FILE__,
+                __LINE__);
             ok = 0;
         }
         if (ok && (readLen > 0)) {
             /* Reallocate for new data. */
             p = OPENSSL_realloc(*data, *len + readLen);
             if (p == NULL) {
-                WOLFPROV_MSG(WP_LOG_COMP_PROVIDER, "OPENSSL_realloc error (%d) in %s:%d", readLen, __FILE__, __LINE__);
+                WOLFPROV_MSG(WP_LOG_COMP_PROVIDER, "OPENSSL_realloc error (%ld) in %s:%d", readLen, __FILE__, __LINE__);
                 ok = 0;
             }
         }
@@ -1335,16 +1338,23 @@ int wp_read_pem_bio(WOLFPROV_CTX *provctx, OSSL_CORE_BIO *coreBio,
         /* Read a line at a time. */
         readLen = BIO_gets(bio, buf, sizeof(buf));
         if (readLen < -1) {
-            WOLFPROV_MSG(WP_LOG_COMP_PROVIDER, "BIO_read error (%d) in %s:%d",
+            WOLFPROV_MSG(WP_LOG_COMP_PROVIDER, "BIO_gets error (%ld) in %s:%d",
                 readLen, __FILE__, __LINE__);
             ok = 0;
         }
+        if (ok && (readLen > 0) &&
+                (!WP_FITS_WORD32((uint64_t)*len + (uint64_t)readLen))) {
+            WOLFPROV_MSG(WP_LOG_COMP_PROVIDER,
+                "Length overflow (%u + %ld) in %s:%d", *len, readLen, __FILE__,
+                __LINE__);
+            ok = 0;
+        }
         if (ok && (readLen > 0)) {
             /* Reallocate for new data. */
             p = OPENSSL_realloc(*data, *len + readLen);
             if (p == NULL) {
                 WOLFPROV_MSG(WP_LOG_COMP_PROVIDER,
-                    "OPENSSL_realloc error (%d) in %s:%d", readLen, __FILE__,
+                    "OPENSSL_realloc error (%ld) in %s:%d", readLen, __FILE__,
                     __LINE__);
                 ok = 0;
             }