From e641c6b738d27c52741d5dcbc457ee33cb68ade7 Mon Sep 17 00:00:00 2001
From: John Bland <john.bland@wolfssl.com>
Date: Wed, 27 Dec 2023 16:06:40 -0500
Subject: [PATCH] when removing the padding for the TLS13 verify message

step, check that the index doesn't wrap around due to a malformed packet
---
 src/internal.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index 2274ab7e2..98dd6cda1 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -21166,7 +21166,8 @@ default:
                     word16 i = (word16)(ssl->buffers.inputBuffer.idx +
                                  ssl->curSize - ssl->specs.aead_mac_size);
 
-                    if (i > ssl->buffers.inputBuffer.length) {
+                    /* check i isn't too big and won't wrap around on --i */
+                    if (i > ssl->buffers.inputBuffer.length || i == 0) {
                         WOLFSSL_ERROR(BUFFER_ERROR);
                         return BUFFER_ERROR;
                     }