SLH-DSA: Fix Integer overflow in msg_encode leading to buffer overflow

SLH-DSA: Fix Integer overflow in msg_encode leading to buffer overflow

Reported by Zehua Qiao and me@snkth.com

An encode message buffer M = 00 || CXT_LEN || CTX || MSG was being
allocated followed by memcpy's into the buffer for CTX and MSG.
If len(MSG) was close to size_t the allocated buffer would be
overwritten.

The fix uses WPACKET to perform the message encoding M = 00 || CXT_LEN || CTX || MSG

Although ML_DSA does a similiar operation, SLH-DSA has to buffer the
encoding because the encoded message is processed multiple times for
PRF_MSG and H_MSG. FOr ML_DSA the encoded message can just be hashed.

Fixes: 2f9e152d86a7 "Add SLH_DSA signature verification."
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Mar 22 00:15:47 2026
(Merged from https://github.com/openssl/openssl/pull/30477)