RSA key import can succeed with an invalid/undefined version

[headscott]

In rsa_import_pkcs1, after handling version == 0 and version == 1, there is no fallback case:

Affected Code
src/pk/rsa/rsa_import.c:57-78

if (version == 0) {
    ...
} else if (version == 1) {
    ...
}
err = CRYPT_OK;

An unsupported version or a not set version retaining its initial value (-1) could therefore fall through and return CRYPT_OK even though no key fields were decoded. The key could be uninitialized.

Suggested Fix
add this branch:

} else {
   err = CRYPT_PK_INVALID_TYPE;
   goto LBL_OUT;
}

This ensures that rsa_import_pkcs1 never reports successful key import unless a supported RSA key version was actually decoded.