From 67b8469179521ddfe492fbc0e4188bc1662ef053 Mon Sep 17 00:00:00 2001
From: JacobBarthelmeh <jacob@wolfssl.com>
Date: Mon, 27 Apr 2026 17:21:30 -0600
Subject: [PATCH] change call to GetSigAlg in ASN original to sanity check
 length

---
 wolfcrypt/src/asn_orig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wolfcrypt/src/asn_orig.c b/wolfcrypt/src/asn_orig.c
index d6568aa5d1..1e9b0dcbe6 100644
--- a/wolfcrypt/src/asn_orig.c
+++ b/wolfcrypt/src/asn_orig.c
@@ -2785,7 +2785,7 @@ static int GetSigAlg(DecodedCert* cert, word32* sigOid, word32 maxIdx)
             int len;
 
             WOLFSSL_MSG("Cert sigAlg is RSASSA-PSS; decoding params");
-            if (GetHeader(cert->source, &tag, &tmpIdx, &len, endSeqIdx, 0) < 0) {
+            if (GetHeader(cert->source, &tag, &tmpIdx, &len, endSeqIdx, 1) < 0) {
                 return ASN_PARSE_E;
             }
             cert->sigParamsIndex  = cert->srcIdx;