From 5da6aacc65f6453e13d54df12be9298cc5135d61 Mon Sep 17 00:00:00 2001
From: Paul Adelsbach <paul.adelsbach@wolfssl.com>
Date: Mon, 20 Apr 2026 16:26:42 -0700
Subject: [PATCH] Add check for all zeros in CreateMpint

---
 src/internal.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/internal.c b/src/internal.c
index 0bf745e59..89a916553 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -4636,6 +4636,13 @@ static int CreateMpint(byte* buf, word32* sz, byte* pad)
         if (buf[i] != 0x00)
             break;
     }
+    /* all-zero buffer encodes as empty mpint per RFC 4251 */
+    if (i == *sz) {
+        *pad = 0;
+        *sz = 0;
+        return WS_SUCCESS;
+    }
+
     *pad = (buf[i] & 0x80) ? 1 : 0;
 
     /* if padding would be needed and have leading 0's already then do not add