From fd8772ac3fd89fce5a0c26c59163c0ccd91aed7b Mon Sep 17 00:00:00 2001 From: Loganaden Velvindron Date: Fri, 3 Jul 2026 03:57:58 +0400 Subject: [PATCH 1/3] quic: Fix buffer underflow --- src/quic.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/quic.c b/src/quic.c index d178f66bce..dcdec84afe 100644 --- a/src/quic.c +++ b/src/quic.c @@ -852,6 +852,11 @@ static int wolfSSL_quic_send_internal(WOLFSSL* ssl) rl = (RecordLayerHeader*)output; ato16(rl->length, &rlen); output += RECORD_HEADER_SZ; + if (length < RECORD_HEADER_SZ) { + WOLFSSL_MSG("WOLFSSL_QUIC_SEND application failed"); + ret = FWRITE_ERROR; + goto cleanup; + } length -= RECORD_HEADER_SZ; ssl->quic.output_rec_remain = rlen; ssl->quic.output_rec_level = ssl->quic.enc_level_write; From 98c48a43b7c3a57bad8e38cfd60f37df4c7bee15 Mon Sep 17 00:00:00 2001 From: Loganaden Velvindron Date: Tue, 7 Jul 2026 08:47:50 +0400 Subject: [PATCH 2/3] move check earlier --- src/quic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/quic.c b/src/quic.c index dcdec84afe..d899e3dd97 100644 --- a/src/quic.c +++ b/src/quic.c @@ -848,15 +848,15 @@ static int wolfSSL_quic_send_internal(WOLFSSL* ssl) ssl->quic.output_rec_remain -= (word32)len; } else { - /* at start of a TLS Record */ - rl = (RecordLayerHeader*)output; - ato16(rl->length, &rlen); - output += RECORD_HEADER_SZ; + /* at start of a TLS Record */ if (length < RECORD_HEADER_SZ) { WOLFSSL_MSG("WOLFSSL_QUIC_SEND application failed"); ret = FWRITE_ERROR; goto cleanup; } + rl = (RecordLayerHeader*)output; + ato16(rl->length, &rlen); + output += RECORD_HEADER_SZ; length -= RECORD_HEADER_SZ; ssl->quic.output_rec_remain = rlen; ssl->quic.output_rec_level = ssl->quic.enc_level_write; From 0cdc7ab583bd1f2c813c87892963328915024123 Mon Sep 17 00:00:00 2001 From: Loganaden Velvindron Date: Tue, 7 Jul 2026 08:51:12 +0400 Subject: [PATCH 3/3] Fix whitespaces --- src/quic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/quic.c b/src/quic.c index d899e3dd97..1b123b9c3e 100644 --- a/src/quic.c +++ b/src/quic.c @@ -848,7 +848,7 @@ static int wolfSSL_quic_send_internal(WOLFSSL* ssl) ssl->quic.output_rec_remain -= (word32)len; } else { - /* at start of a TLS Record */ + /* at start of a TLS Record */ if (length < RECORD_HEADER_SZ) { WOLFSSL_MSG("WOLFSSL_QUIC_SEND application failed"); ret = FWRITE_ERROR;