add ASN.1 sequence bounds checks in PKey parsing

Validate sequence size before indexed access in readPrivateKey (RSA/DSA)
and readDHParameter, matching C OpenSSL's ASN1 template validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: kares

src/main/java/org/jruby/ext/openssl/impl/PKey.java

@@ -104,6 +104,9 @@ public static KeyPair readPrivateKey(final Type type, final PrivateKeyInfo keyIn
         switch (type) {
             case RSA:
                 seq = (ASN1Sequence) keyInfo.parsePrivateKey();
+                if (seq.size() < 9) {
+                    throw new IOException("malformed RSA private key (expected 9 elements, got " + seq.size() + ")");
+                }
                 ASN1Integer mod = (ASN1Integer) seq.getObjectAt(1);
                 ASN1Integer pubExp = (ASN1Integer) seq.getObjectAt(2);
                 ASN1Integer privExp = (ASN1Integer) seq.getObjectAt(3);
@@ -133,6 +136,9 @@ public static KeyPair readPrivateKey(final Type type, final PrivateKeyInfo keyIn
                 } else {
                     // Traditional "DSA PRIVATE KEY" format: SEQUENCE { version, p, q, g, y, x }
                     seq = (ASN1Sequence) parsedDSAKey;
+                    if (seq.size() < 6) {
+                        throw new IOException("malformed DSA private key (expected 6 elements, got " + seq.size() + ")");
+                    }
                     ASN1Integer p = (ASN1Integer) seq.getObjectAt(1);
                     ASN1Integer q = (ASN1Integer) seq.getObjectAt(2);
                     ASN1Integer g = (ASN1Integer) seq.getObjectAt(3);
@@ -273,7 +279,11 @@ public static PublicKey readDSAPublicKey(final KeyFactory dsaFactory, final byte
     // d2i_DHparams_bio
     public static DHParameterSpec readDHParameter(final byte[] input) throws IOException {
         ASN1InputStream aIn = new ASN1InputStream(input);
-        ASN1Sequence seq = (ASN1Sequence) aIn.readObject();
+        ASN1Primitive obj = aIn.readObject();
+        if (!(obj instanceof ASN1Sequence) || ((ASN1Sequence) obj).size() < 2) {
+            throw new IOException("malformed DH parameters (expected sequence with at least 2 elements)");
+        }
+        ASN1Sequence seq = (ASN1Sequence) obj;
         BigInteger p = ((ASN1Integer) seq.getObjectAt(0)).getValue();
         BigInteger g = ((ASN1Integer) seq.getObjectAt(1)).getValue();
         return new DHParameterSpec(p, g);