commit 3175fc3be239c9029b32ec9ef87eff7763284890
author Gilles Peskine <Gilles.Peskine@arm.com> Thu Mar 06 15:15:20 2025 +0100
committer Gilles Peskine <Gilles.Peskine@arm.com> Thu Mar 06 19:10:41 2025 +0100
tree 29799ec7a56ce522193a7b2e2e76fb4f633636e1
parent 7719169ef4d73d18a8e3d4247881dec108c6a324

Fix end check before memmove

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

library/ssl_msg.c

diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 436870b..1dca728 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -3377,7 +3377,7 @@
 #else
         size_t const in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
 #endif
-        if (payload_end + ssl->badmac_seen_or_in_hsfraglen > ssl->in_buf + in_buf_len) {
+        if (payload_end + ssl->in_msglen > ssl->in_buf + in_buf_len) {
             MBEDTLS_SSL_DEBUG_MSG(1,
                                   ("Shouldn't happen: no room to move handshake fragment %"
                                    MBEDTLS_PRINTF_SIZET " from %p to %p (buf=%p len=%"