dtls.c: fix length check in check_server_certificate.

Fixes potential out-of-bounds read.

Signed-off-by: Achim Kraus <achim.kraus@cloudcoap.net>

Author: boaks

dtls.c

@@ -3436,6 +3436,11 @@ check_server_certificate(dtls_context_t *ctx,
 
   data += DTLS_HS_LENGTH;
 
+  if (data_length < DTLS_HS_LENGTH + DTLS_EC_SUBJECTPUBLICKEY_SIZE + sizeof(uint24)) {
+    dtls_alert("the packet length does not match the expected\n");
+    return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR);
+  }
+
   if (dtls_uint24_to_int(data) != DTLS_EC_SUBJECTPUBLICKEY_SIZE) {
     dtls_alert("expect length of %zu bytes for certificate\n",
 	       DTLS_EC_SUBJECTPUBLICKEY_SIZE);