BUG: Missing bounds validation in ASN.1 signature parsing

[andrinoff]

Describe the bug

In pgp/yubikey.go lines 428-440, parseASN1Signature() doesn't validate slice bounds before accessing:

rLen := int(der[pos])
pos++
rVal := new(big.Int).SetBytes(der[pos : pos+rLen])  // No bounds check
pos += rLen

If pos + rLen exceeds len(der), panic occurs (index out of range). Initial check only validates len(der) < 6, but not actual slice access.

To reproduce

1. Send malformed ECDSA signature with large rLen value
2. Parser attempts slice access beyond array bounds
3. Application panics with index out of range

Expected behavior

Add bounds validation before slice access:

rLen := int(der[pos])
pos++
if pos+rLen > len(der) {
    return nil, nil, fmt.Errorf("ASN.1 signature truncated: r length overflow")
}
rVal := new(big.Int).SetBytes(der[pos : pos+rLen])
pos += rLen

Screenshots

N/A

Additional context

• File: pgp/yubikey.go
• Lines: 428-440
• Severity: High - crash on malformed signatures, potential DoS
• Fix complexity: Easy - add bounds check before slice operations