From cf6bdc5e4df49e5583d3fb4d2296779785f10683 Mon Sep 17 00:00:00 2001
From: Alexander Sosedkin <asosedkin@redhat.com>
Date: Mon, 30 Mar 2026 17:46:40 +0200
Subject: [PATCH] lib/pkcs11_privkey: guard against overreading on short
 ciphertexts

This is an alternative fix for the callee side.

Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
Fixes: #1814
Fixes: CVE-2026-5260
Fixes: GNUTLS-SA-2026-04-29-10
CVSS: 5.9 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

CVE: CVE-2026-5260
Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/cf6bdc5e4df49e5583d3fb4d2296779785f10683]

Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
---
diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c
index 568474e..e133c49 100644
--- a/lib/pkcs11_privkey.c
+++ b/lib/pkcs11_privkey.c
@@ -838,7 +838,7 @@ int _gnutls_pkcs11_privkey_decrypt_data2(gnutls_pkcs11_privkey_t key,
 	if (ret != 0)
 		return gnutls_assert_val(GNUTLS_E_LOCKING_ERROR);
 
-	buffer = gnutls_malloc(siglen);
+	buffer = gnutls_malloc(MAX((size_t)siglen, plaintext_size));
 	if (!buffer) {
 		gnutls_assert();
 		return GNUTLS_E_MEMORY_ERROR;