From 94ef87050a698bfbfd0aadaf23c77a63599ba2b8 Mon Sep 17 00:00:00 2001
From: Alexandre Petit <62973006+AlexpFr@users.noreply.github.com>
Date: Mon, 9 Mar 2026 15:37:11 +0100
Subject: [PATCH] SSH Agent: Improve OpenSSH certificate validation

- Check elements non-empty before accessing first()
- Validate minimum 2 elements (type + nonce)
- Reject invalid/unsupported certificate types
- Verify Base64 nonce decoding success
---
 src/sshagent/OpenSSHKey.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/sshagent/OpenSSHKey.cpp b/src/sshagent/OpenSSHKey.cpp
index db0d2ae78..fd0c7447a 100644
--- a/src/sshagent/OpenSSHKey.cpp
+++ b/src/sshagent/OpenSSHKey.cpp
@@ -693,7 +693,7 @@ bool OpenSSHKey::parseCertificate(QByteArray& data)
         "sk-ecdsa-sha2-nistp521-cert-v01@openssh.com",
     };
 
-    if(!certificateTypeList.contains(elements.first())) {
+    if(elements.isEmpty() || elements.size() < 2 || !certificateTypeList.contains(elements.first())) {
         m_error = tr("Invalid or unsupported certificate file");
         return false;
     }
@@ -701,6 +701,11 @@ bool OpenSSHKey::parseCertificate(QByteArray& data)
     m_certificateType = elements.first();
     m_rawCertificateData = QByteArray::fromBase64(elements[1].toLatin1());
 
+    if (m_rawCertificateData.isEmpty()) {
+        m_error = tr("Base64 decoding failed");
+        return false;
+    }
+
     return true;
 }