From fb0b003aaa57499519fb9d8c26b19e66c011e4be Mon Sep 17 00:00:00 2001
From: Alexandre Petit <62973006+AlexpFr@users.noreply.github.com>
Date: Mon, 9 Mar 2026 17:00:06 +0100
Subject: [PATCH] SSH Agent: Skip cert removal if writeCertificate() fails

Avoid sending invalid SSH_AGENTC_REMOVE_IDENTITY to agent when KeePassXC
cannot read the certificate data itself.

Prevents malformed removal requests for unreadable certificates.
---
 src/sshagent/SSHAgent.cpp | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/sshagent/SSHAgent.cpp b/src/sshagent/SSHAgent.cpp
index 44619b1c6..c793da9b5 100644
--- a/src/sshagent/SSHAgent.cpp
+++ b/src/sshagent/SSHAgent.cpp
@@ -422,15 +422,16 @@ bool SSHAgent::removeIdentity(OpenSSHKey& key)
 
     QByteArray certificateData;
     BinaryStream certificateStream(&certificateData);
-    key.writeCertificate(certificateStream, false);
+    if (key.writeCertificate(certificateStream, false)) {
+        requestCertificate.write(SSH_AGENTC_REMOVE_IDENTITY);
+        requestCertificate.write(certificateData);
+        QByteArray responseCertificateData;
 
-    requestCertificate.write(SSH_AGENTC_REMOVE_IDENTITY);
-    requestCertificate.write(certificateData);
+        return (sendMessage(requestData, responseData) &&
+            sendMessage(requestCertificateData, responseCertificateData));
+    }
 
-    QByteArray responseCertificateData;
-
-    return (sendMessage(requestData, responseData) &&
-        sendMessage(requestCertificateData, responseCertificateData));
+    return (sendMessage(requestData, responseData));
 }
 
 /**