Merge commit from fork

DER: reject truncated lengths and add regression tests

Author: tomato42

src/ecdsa/der.py

@@ -163,6 +163,8 @@ def remove_constructed(string):
         )
     tag = s0 & 0x1F
     length, llen = read_length(string[1:])
+    if length > len(string) - 1 - llen:
+        raise UnexpectedDER("Length longer than the provided buffer")
     body = string[1 + llen : 1 + llen + length]
     rest = string[1 + llen + length :]
     return tag, body, rest
@@ -206,6 +208,8 @@ def remove_implicit(string, exp_class="context-specific"):
 
     tag = s0 & 0x1F
     length, llen = read_length(string[1:])
+    if length > len(string) - 1 - llen:
+        raise UnexpectedDER("Length longer than the provided buffer")
     body = string[1 + llen : 1 + llen + length]
     rest = string[1 + llen + length :]
     return tag, body, rest
@@ -229,6 +233,8 @@ def remove_octet_string(string):
         n = str_idx_as_int(string, 0)
         raise UnexpectedDER("wanted type 'octetstring' (0x04), got 0x%02x" % n)
     length, llen = read_length(string[1:])
+    if length > len(string) - 1 - llen:
+        raise UnexpectedDER("Length longer than the provided buffer")
     body = string[1 + llen : 1 + llen + length]
     rest = string[1 + llen + length :]
     return body, rest

src/ecdsa/test_der.py

@@ -600,3 +600,23 @@ def test_oids(ids):
     decoded_oid, rest = remove_object(encoded_oid)
     assert rest == b""
     assert decoded_oid == ids
+
+def test_remove_octet_string_rejects_truncated_length():
+    # OCTET STRING: declared length 4096, but only 3 bytes present
+    bad = b"\x04\x82\x10\x00" + b"ABC"
+    with pytest.raises(UnexpectedDER, match="Length longer than the provided buffer"):
+        remove_octet_string(bad)
+
+def test_remove_constructed_rejects_truncated_length():
+    # Constructed tag: 0xA0 (context-specific constructed, tag=0)
+    # declared length 4096, but only 3 bytes present
+    bad = b"\xA0\x82\x10\x00" + b"ABC"
+    with pytest.raises(UnexpectedDER, match="Length longer than the provided buffer"):
+        remove_constructed(bad)
+
+def test_remove_implicit_rejects_truncated_length():
+    # IMPLICIT primitive context-specific tag 0: 0x80
+    # declared length 4096, but only 3 bytes present
+    bad = b"\x80\x82\x10\x00" + b"ABC"
+    with pytest.raises(UnexpectedDER, match="Length longer than the provided buffer"):
+        remove_implicit(bad)