Issue: Missing Signature Length Validation in ltc_pkcs_1_pss_decode_mgf1

[headscott]

ltc_pkcs_1_pss_decode_mgf1 must ensure that siglen is exactly equal to the calculated modulus_len.

Later in the function, (modulus_len - hLen - 1) + hLen = modulus_len - 1 bytes are copied from sig starting at offset 0. Without an explicit length check, a too-short signature can therefore cause an out-of-bounds read.

The signature originates from the peer's certificate and must be treated as untrusted input. While the current caller, rsa_verify_hash_v2, happens to satisfy this requirement through a non-obvious calculation involving modulus_bitlen%8, the validation should be enforced directly in ltc_pkcs_1_pss_decode_mgf1.

Affected Code
src/pk/pkcs1/pkcs_1_pss_decode.c:53

   /* check sizes */
   if ((saltlen > modulus_len) ||
       (modulus_len < hLen + saltlen + 2)) {
      return CRYPT_PK_INVALID_SIZE;
   }

Suggested Fix

   /* check sizes */
   if ((saltlen > modulus_len) ||
       (modulus_len < hLen + saltlen + 2) ||
       (siglen != modulus_len)) {
      return CRYPT_PK_INVALID_SIZE;
   }