From 123b88e03210aed6329e9f5edd463325ea0264bd Mon Sep 17 00:00:00 2001
From: Greyson Parrelli <greyson@signal.org>
Date: Thu, 23 Oct 2025 12:00:51 -0400
Subject: [PATCH] Validate attachment key size.

---
 .../signalservice/api/crypto/AttachmentCipherInputStream.kt   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt
index cfc8256d21..9478cc986f 100644
--- a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt
+++ b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt
@@ -362,7 +362,11 @@ object AttachmentCipherInputStream {
 
   private class CombinedKeyMaterial(val aesKey: ByteArray, val macKey: ByteArray) {
     companion object {
+      @Throws(InvalidMessageException::class)
       fun from(combinedKeyMaterial: ByteArray): CombinedKeyMaterial {
+        if (combinedKeyMaterial.size != CIPHER_KEY_SIZE + MAC_KEY_SIZE) {
+          throw InvalidMessageException("Invalid combined key material size: ${combinedKeyMaterial.size}")
+        }
         val parts = Util.split(combinedKeyMaterial, CIPHER_KEY_SIZE, MAC_KEY_SIZE)
         return CombinedKeyMaterial(parts[0], parts[1])
       }