Commit c34ed66980 for strongswan.org

commit c34ed669805550c80bb9475b72551935a1d1317a
Author: raghu netrakar <raghu@security.bugqore.com>
Date:   Fri Oct 23 15:26:55 2026 +0530

    pkcs5: Verify IV length before decrypting PBES2 data

    For PBES1 and PKCS#12 the IV is derived to the cipher's block size, but
    for PBES2 it is taken verbatim from the parsed parameters. An
    EncryptedPrivateKeyInfo (or PKCS#7 encrypted-data) with a PBES2 IV
    shorter than the block size and block-aligned ciphertext passes the
    existing block-size check and reaches the CBC crypter, which reads a
    full IV block past the allocation. Validate the IV length before
    decrypting, like the other callers of crypter->decrypt() already do.

    Closes strongswan/strongswan#3184

    Fixes: 4076e3ee9121 ("Extract PKCS#5 handling from pkcs8 plugin to separate helper class")
    Fixes: fd1ff46f6143 ("Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files.")

diff --git a/src/libstrongswan/crypto/pkcs5.c b/src/libstrongswan/crypto/pkcs5.c
index e01010b90a..19da811bdf 100644
--- a/src/libstrongswan/crypto/pkcs5.c
+++ b/src/libstrongswan/crypto/pkcs5.c
@@ -386,6 +386,12 @@ METHOD(pkcs5_t, decrypt, bool,
 		default:
 			return FALSE;
 	}
+	if (iv.len != this->crypter->get_iv_size(this->crypter))
+	{
+		DBG1(DBG_ASN, "  IV length does not match expected %zu bytes",
+			 this->crypter->get_iv_size(this->crypter));
+		return FALSE;
+	}
 	return decrypt_generic(this, password, data, decrypted, kdf,
 						   keymat, key, iv);
 }