From 7e339717227ed6675e8a5d965371de5f791874f7 Mon Sep 17 00:00:00 2001
From: Guo Yitao <gyt@aliyun>
Date: Thu, 26 Feb 2026 14:19:25 +0800
Subject: [PATCH] fix: fix logic defects in certificate chain length
 calculation

1.Avoid infinite loops caused by circular certificate chains.

2.Prevent potential integer overflow issues.

Signed-off-by: Guo Yitao <414989582@qq.com>
---
 code_sign/verify_cert_chain.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/code_sign/verify_cert_chain.c b/code_sign/verify_cert_chain.c
index 8163da9..439d17b 100644
--- a/code_sign/verify_cert_chain.c
+++ b/code_sign/verify_cert_chain.c
@@ -195,6 +195,9 @@ void code_sign_verify_certchain(const void *raw_pkcs7, size_t pkcs7_len,
 					break;
 				}
 				cert_chain_depth_without_root++;
+				if (cert_chain_depth_without_root > (source->max_path_depth - 1)) {
+ 	 				break;
+ 	 			}
 				// search again for current issuer's issuer
 				issuer = cert->issuer;
 				cert = pkcs7->certs;