HSSPublicKey reads the level count L from raw and X.509 public-key encodings without checking its range. HSSSignature only checks that Nspk + 1 equals L before allocating arrays sized by these values.
A malformed key and a four-byte signature prefix can therefore request very large reference arrays or negative array sizes before the signature body is parsed. Outcomes include memory exhaustion and NegativeArraySizeException. This requires an application to accept the supplied HSS/LMS key and invoke signature verification; it does not imply that every TLS or certificate path uses this algorithm. Expected behavior: HSS public keys must have 1 through 8 levels, and signature allocation sizes must be bounded before allocation. --------- - [x] I confirm that I make this contribution in accordance with the [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). ------------- Commit messages: - 8396408: HSS/LMS key levels are not bounded before signature array allocation Changes: https://git.openjdk.org/jdk/pull/33670/files Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=33670&range=00 Issue: https://bugs.openjdk.org/browse/JDK-8396408 Stats: 121 lines in 2 files changed: 120 ins; 0 del; 1 mod Patch: https://git.openjdk.org/jdk/pull/33670.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33670/head:pull/33670 PR: https://git.openjdk.org/jdk/pull/33670
