From bb33bc6988d88a3fc085d65b252b98a3d38b93b5 Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Thu, 9 Jul 2026 16:46:28 -0700
Subject: [PATCH] fix: validate req_size in cert erasetrusted

---
 src/wh_server_cert.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/wh_server_cert.c b/src/wh_server_cert.c
index db0871605..469dae8ce 100644
--- a/src/wh_server_cert.c
+++ b/src/wh_server_cert.c
@@ -931,6 +931,15 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
             whMessageCert_EraseTrustedRequest req  = {0};
             whMessageCert_SimpleResponse      resp = {0};
 
+            /* Validate minimum size */
+            if (req_size < sizeof(req)) {
+                resp.rc = WH_ERROR_BADARGS;
+                wh_MessageCert_TranslateSimpleResponse(
+                    magic, &resp, (whMessageCert_SimpleResponse*)resp_packet);
+                *out_resp_size = sizeof(resp);
+                break;
+            }
+
             /* Convert request struct */
             wh_MessageCert_TranslateEraseTrustedRequest(
                 magic, (whMessageCert_EraseTrustedRequest*)req_packet, &req);