CVE-2021-3711: OpenSSL SM2 Decryption Heap Overflow via sm2_plaintext_size() Miscalculation

CVE-2021-3711 is a heap buffer overflow in OpenSSL's SM2 decryption implementation. The function sm2_plaintext_size() in crypto/sm2/sm2_crypt.c incorrectly calculates the output buffer size needed for decryption. It uses a fixed overhead formula: overhead = 10 + 2 * field_size + md_size, which assumes both EC point coordinates (C1x, C1y) occupy exactly field_size bytes each in their ASN1 DER INTEGER encoding. However, DER-encoded BIGNUMs use minimum-length encoding — small-valued coordinates take far fewer bytes. If an attacker crafts a ciphertext with small C1x/C1y values, the actual DER overhead is less than assumed, meaning the C2 payload field occupies more bytes than expected. The caller (pkey_sm2_decrypt) allocates a buffer using sm2_plaintext_size(), but sm2_decrypt() then writes sm2_ctext->C2->length bytes — which can be up to 62 bytes larger than the buffer — causing a heap overflow. This directly enables heap corruption via a malicious SM2 certificate or ciphertext.