forked from wolfSSL/wolfssl
api: make sure len doesn't overrun the input buffer
This commit is contained in:
@@ -99175,6 +99175,8 @@ static int test_dtls_frag_ch_count_records(byte* b, int len)
|
|||||||
records++;
|
records++;
|
||||||
dtlsRH = (DtlsRecordLayerHeader*)b;
|
dtlsRH = (DtlsRecordLayerHeader*)b;
|
||||||
recordLen = (dtlsRH->length[0] << 8) | dtlsRH->length[1];
|
recordLen = (dtlsRH->length[0] << 8) | dtlsRH->length[1];
|
||||||
|
if (recordLen > (size_t)len)
|
||||||
|
break;
|
||||||
b += sizeof(DtlsRecordLayerHeader) + recordLen;
|
b += sizeof(DtlsRecordLayerHeader) + recordLen;
|
||||||
len -= sizeof(DtlsRecordLayerHeader) + recordLen;
|
len -= sizeof(DtlsRecordLayerHeader) + recordLen;
|
||||||
}
|
}
|
||||||
|
Reference in New Issue
Block a user