if (di->digest.len > HASH_LENGTH_MAX) {
if (di->digest.len > len) {
DecryptSigBlock(SECOidTag *tagp, unsigned char *digest, SECKEYPublicKey *key,		SECItem *sig, char *wincx){    SGNDigestInfo *di   = NULL;    unsigned char *buf  = NULL;    SECStatus      rv;    SECOidTag      tag;    SECItem        it;    if (key == NULL) goto loser;    it.len  = SECKEY_PublicKeyStrength(key);    if (!it.len) goto loser;    it.data = buf = (unsigned char *)PORT_Alloc(it.len);    if (!buf) goto loser;    /* decrypt the block */    rv = PK11_VerifyRecover(key, sig, &it, wincx);    if (rv != SECSuccess) goto loser;    di = SGN_DecodeDigestInfo(&it);    if (di == NULL) goto sigloser;    /*    ** Finally we have the digest info; now we can extract the algorithm    ** ID and the signature block    */    tag = SECOID_GetAlgorithmTag(&di->digestAlgorithm);    /* XXX Check that tag is an appropriate algorithm? */    if (di->digest.len > HASH_LENGTH_MAX) {	PORT_SetError(SEC_ERROR_OUTPUT_LEN);	goto loser;    }    PORT_Memcpy(digest, di->digest.data, di->digest.len);    *tagp = tag;    goto done;  sigloser:    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);  loser:    rv = SECFailure;  done:    if (di   != NULL) SGN_DestroyDigestInfo(di);    if (buf  != NULL) PORT_Free(buf);        return rv;}