GOST IMIT verification reads past its eight-byte stack tag

gost_imit_verify constructs the expected MAC in an eight-byte stack array, then compares buflen bytes without bounding the caller's supplied length. Any verification request longer than eight bytes reads beyond tbuf into adjacent stack storage.

Vulnerable code

In cipher/gost28147.c, function gost_imit_verify:

static gcry_err_code_t
gost_imit_verify (gcry_mac_hd_t h, const unsigned char *buf, size_t buflen)
{
  unsigned char tbuf[8];

  gost_imit_finish (h);

  buf_put_le32 (tbuf+0, h->u.imit.n1);
  buf_put_le32 (tbuf+4, h->u.imit.n2);

  return buf_eq_const(tbuf, buf, buflen) ?
             GPG_ERR_NO_ERROR : GPG_ERR_CHECKSUM;
}

Why it matters

The ASan reproducer passed a 4,096-byte candidate tag and observed the constant-time comparison reading beyond tbuf; a length guard made it return cleanly. An attacker needs access to an API path that forwards an oversized MAC length. The immediate, demonstrated outcome is an out-of-bounds stack read and process crash. Although comparison results depend on adjacent bytes, no practical stack disclosure was established.

Proposed fix

Reject buflen > sizeof tbuf before the comparison, using the API's normal invalid-length or checksum error. If variable truncation is intentionally supported, preserve and document lengths one through eight; otherwise require the four-byte length advertised by gost_imit_get_maclen(), not eight. Add ASan regression cases for lengths zero, one, four, eight, nine, and 4,096, together with valid and invalid advertised-length tags.