From 36931c8b98876527c0095772928eb473a71917a5 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Mon, 6 Apr 2026 12:42:35 -0700
Subject: [PATCH] Ensure the SNI extension has at least OPAQUE16_LEN bytes in
 TLSX_SNI_GetFromBuffer.

Thanks to Zou Dikai for the report.
---
 src/tls.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/tls.c b/src/tls.c
index 02a0881352..e9c198cec7 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -2800,6 +2800,9 @@ int TLSX_SNI_GetFromBuffer(const byte* clientHello, word32 helloSz,
         } else {
             word16 listLen;
 
+            if (extLen < OPAQUE16_LEN)
+                return BUFFER_ERROR;
+
             ato16(clientHello + offset, &listLen);
             offset += OPAQUE16_LEN;