Commit 9262a43021 for openssl.org

commit 9262a4302140c6cf01e02ab7517f85239def938c
Author: Neil Horman <nhorman@openssl.org>
Date:   Fri Oct 23 10:55:22 2026 -0400

    PEM_bio_read_PrivateKey: harden against malformed keys

    RSA Multiprime private keys can be imported via PEM_bio_read_PrivateKey.
    If a malformed private key is supplied with more primes that openssl
    supports, or if it has factors larger than the modulus, we can consume
    exponential memory or cpu time.

    Fix it by checking the number of primes on import as well as the factor
    size

    Fixes: openssl/private#1004
    Fixes: ANT-2026-XFGWSOI5

    Assisted-by: Claude:claude-sonnet-4-6
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Fri Nov  6 21:19:22 2026
    Merged-from: https://github.com/openssl/openssl/pull/33361

diff --git a/crypto/rsa/rsa_asn1.c b/crypto/rsa/rsa_asn1.c
index bdd83b414b..21ca76d84c 100644
--- a/crypto/rsa/rsa_asn1.c
+++ b/crypto/rsa/rsa_asn1.c
@@ -42,6 +42,15 @@ static int rsa_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
             /* not a multi-prime key, skip */
             return 1;
         }
+        /*
+         * A product is kept for each extra prime, so refuse more of them
+         * than the rest of the RSA code supports before computing any.
+         */
+        if (sk_RSA_PRIME_INFO_num(((RSA *)*pval)->prime_infos)
+            > RSA_MAX_PRIME_NUM - 2) {
+            ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_MULTI_PRIME_KEY);
+            return 0;
+        }
         return (ossl_rsa_multip_calc_product((RSA *)*pval) == 1) ? 2 : 0;
     }
     return 1;
diff --git a/crypto/rsa/rsa_mp.c b/crypto/rsa/rsa_mp.c
index d73af13528..871ddcd622 100644
--- a/crypto/rsa/rsa_mp.c
+++ b/crypto/rsa/rsa_mp.c
@@ -82,6 +82,11 @@ int ossl_rsa_multip_calc_product(RSA *rsa)
             if (pinfo->pp == NULL)
                 goto err;
         }
+        if (BN_num_bits(p1) > OPENSSL_RSA_MAX_MODULUS_BITS
+            || BN_num_bits(p2) > OPENSSL_RSA_MAX_MODULUS_BITS) {
+            ERR_raise(ERR_LIB_RSA, RSA_R_INVALID_MULTI_PRIME_KEY);
+            goto err;
+        }
         if (!BN_mul(pinfo->pp, p1, p2, ctx))
             goto err;
         /* save previous one */