From 118d3a8226a105532257e47e7eadba2918d93bca Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Mon, 1 Jun 2026 18:32:46 +0200 Subject: [PATCH] F-5583: evict oldest DTLS 1.3 epoch slot, not the last eligible one Dtls13NewEpochSlot never updated oldestNumber after picking a candidate, so every eligible epoch compared "older" than the sentinel and the last eligible slot was returned instead of the lowest epoch number. Update oldestNumber alongside oldest so the true minimum is evicted. --- src/dtls13.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/dtls13.c b/src/dtls13.c index 299dafca92..0de419def8 100644 --- a/src/dtls13.c +++ b/src/dtls13.c @@ -2369,7 +2369,6 @@ static Dtls13Epoch* Dtls13NewEpochSlot(WOLFSSL* ssl) w64wrapper oldestNumber; int i; - /* FIXME: add max function */ oldestNumber = w64From32((word32)-1, (word32)-1); oldest = NULL; @@ -2380,8 +2379,10 @@ static Dtls13Epoch* Dtls13NewEpochSlot(WOLFSSL* ssl) if (!w64Equal(e->epochNumber, ssl->dtls13Epoch) && !w64Equal(e->epochNumber, ssl->dtls13PeerEpoch) && - w64LT(e->epochNumber, oldestNumber)) + w64LT(e->epochNumber, oldestNumber)) { oldest = e; + oldestNumber = e->epochNumber; + } } if (oldest == NULL)