--- crypto/openssl/crypto/cms/cms_pwri.c.orig
+++ crypto/openssl/crypto/cms/cms_pwri.c
@@ -215,7 +215,7 @@
         /* Check byte failure */
         goto err;
     }
-    if (inlen < (size_t)(tmp[0] - 4)) {
+    if (inlen < 4 + (size_t)tmp[0]) {
         /* Invalid length value */
         goto err;
     }