CVE-2021-3711: SM2 Plaintext Size Miscalculation Leading to Heap Overflow

The OpenSSL SM2 decryption implementation contains a heap buffer overflow vulnerability in the plaintext size calculation. The sm2_plaintext_size() function attempts to calculate the plaintext length by subtracting a fixed "overhead" from the ciphertext length. This overhead calculation incorrectly assumes that ASN.1-encoded elliptic curve point coordinates (C1x, C1y) always occupy exactly field_size bytes. However, these integers can have an additional padding byte when the MSB is set (ASN.1 negative number disambiguation), or be shorter than field_size. When the actual ciphertext encoding uses less space than calculated, the plaintext_size is underestimated, causing applications to allocate smaller buffers than needed. The sm2_decrypt() function then writes the actual plaintext (which is larger) into this undersized buffer, causing a heap overflow.