From aa3b80bc9c40a72a4b972e183e33e13393be591c Mon Sep 17 00:00:00 2001
From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com>
Date: Sun, 25 May 2025 16:05:54 -0400
Subject: [PATCH] crypto/tls: signature_algorithms in CertificateRequest can't
 be empty Change-Id: I6a6a4656ab97e1f247df35b2589cd73461b4ac76 Reviewed-on:
 https://go-review.googlesource.com/c/go/+/675917 Auto-Submit: Filippo
 Valsorda <filippo@golang.org> Reviewed-by: David Chase <drchase@google.com>
 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Daniel
 McCarney <daniel@binaryparadox.net> LUCI-TryBot-Result: Go LUCI
 <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

---
 handshake_messages.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/handshake_messages.go b/handshake_messages.go
index 476a441..52fcf02 100644
--- a/handshake_messages.go
+++ b/handshake_messages.go
@@ -1790,7 +1790,7 @@ func (m *certificateRequestMsg) unmarshal(data []byte) bool {
 		}
 		sigAndHashLen := uint16(data[0])<<8 | uint16(data[1])
 		data = data[2:]
-		if sigAndHashLen&1 != 0 {
+		if sigAndHashLen&1 != 0 || sigAndHashLen == 0 {
 			return false
 		}
 		if len(data) < int(sigAndHashLen) {