Avoid false positives in bounds check
The size of the buffer already accounts for the extra data before the actual
message, so the allowed length is SSL_MAX_CONTENT_LEN starting from _msg
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index c0386b6..49ea5a2 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -287,7 +287,7 @@
{
int ret;
unsigned char *p = buf;
- const unsigned char *end = ssl->out_buf + MBEDTLS_SSL_MAX_CONTENT_LEN;
+ const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
size_t kkpp_len;
*olen = 0;