From a7dce987971d5baee333519b02ee83fc5f2dcb32 Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Wed, 29 Nov 2023 19:11:49 +0100
Subject: [PATCH] Don't touch processReply state in DoApplicationData

---
 src/internal.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/src/internal.c b/src/internal.c
index b7c8111a8..6c57df04a 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -19640,18 +19640,12 @@ int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx, int sniff)
     *inOutIdx = idx;
 #ifdef WOLFSSL_DTLS13
     if (ssl->options.connectState == WAIT_FINISHED_ACK) {
-        /* Reset the processReply state since
-         * we finished processing this message. */
-        ssl->options.processReply = doProcessInit;
         /* DTLS 1.3 is waiting for an ACK but we can still return app data. */
         return APP_DATA_READY;
     }
 #endif
 #ifdef HAVE_SECURE_RENEGOTIATION
     if (IsSCR(ssl)) {
-        /* Reset the processReply state since
-         * we finished processing this message. */
-        ssl->options.processReply = doProcessInit;
         /* If we are in a secure renegotiation then APP DATA is treated
          * differently */
         return APP_DATA_READY;
@@ -21211,7 +21205,13 @@ default:
                                                 &ssl->buffers.inputBuffer.idx,
                                                               NO_SNIFF)) != 0) {
                         WOLFSSL_ERROR(ret);
-                        return ret;
+                    #if defined(WOLFSSL_DTLS13) || \
+                        defined(HAVE_SECURE_RENEGOTIATION)
+                        /* Not really an error. We will return after cleaning
+                         * up the processReply state. */
+                        if (ret != APP_DATA_READY)
+                    #endif
+                            return ret;
                     }
                     break;
 
@@ -21334,6 +21334,11 @@ default:
              * by higher layers. */
             if (ret != 0)
                 return ret;
+#endif
+#if defined(WOLFSSL_DTLS13) || defined(HAVE_SECURE_RENEGOTIATION)
+            /* Signal to user that we have application data ready to read */
+            if (ret == APP_DATA_READY)
+                return ret;
 #endif
             /* It is safe to shrink the input buffer here now. local vars will
              * be reset to the new starting value. */