From 07c8c5c8caa846ebc0b572dba0a878d1123c2950 Mon Sep 17 00:00:00 2001
From: JacobBarthelmeh <jacob@wolfssl.com>
Date: Sat, 28 Oct 2023 16:13:45 -0600
Subject: [PATCH] sanity check on length before ato16 with SRTP

---
 src/tls.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/tls.c b/src/tls.c
index 9bbabfb14..38d7e8cef 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -5685,6 +5685,12 @@ static int TLSX_UseSRTP_Parse(WOLFSSL* ssl, const byte* input, word16 length,
         /* parse remainder one profile at a time, looking for match in CTX */
         ret = 0;
         for (i=offset; i<length; i+=OPAQUE16_LEN) {
+            if (length < (i + OPAQUE16_LEN)) {
+                WOLFSSL_MSG("Unexpected length when parsing SRTP profile");
+                ret = BUFFER_ERROR;
+                break;
+            }
+
             ato16(input+i, &profile_value);
             /* find first match */
             if (profile_value < 16 &&