RSA-PSS verification copies a full digest from an unchecked short opaque MPI

When RSA-PSS verification is told that the message is already hashed, it obtains an opaque MPI pointer but does not compare the MPI's bit length with the selected digest length. It unconditionally copies hlen bytes. A caller-supplied short opaque value therefore causes an out-of-bounds read before signature verification fails or continues with adjacent bytes.

Vulnerable code

In cipher/rsa-common.c, function _gcry_rsa_pss_verify:

if (!hashed_already)
  {
    _gcry_md_write (hd, p, (input_nbits+7)/8);
    digest = _gcry_md_read (hd, 0);
    memcpy (mhash, digest, hlen);
    _gcry_md_reset (hd);
  }
else
  memcpy (mhash, p, hlen);

Why it matters

The ASan reproducer selected SHA-512 and supplied a one-byte opaque hash; verification performed a 64-byte read past that allocation. An exact input-length check made the same case return an error. The caller must reach the low-level verification path with hashed_already and malformed MPI input, so the demonstrated impact is a reliable memory-safety violation and likely denial of service, not proven disclosure.

Proposed fix

For prehashed input, require input_nbits to represent exactly hlen bytes and reject non-byte-aligned or otherwise noncanonical lengths before memcpy. Keep the ordinary unhashed-message path unchanged. Add ASan tests for zero-length, one-byte, hlen-minus-one, exact, and hlen-plus-one opaque MPIs for every supported PSS digest size, plus a valid signature regression.