Merge pull request #9973 from JacobBarthelmeh/static_analysis

dgarske · web-flow · commit 77c741805240 · 2026-03-16T13:46:53.000-06:00
fix to sanity check on importing raw session key info
diff --git a/src/internal.c b/src/internal.c
@@ -1169,7 +1169,7 @@ static int ImportKeyState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver,
         XMEMCPY(keys->server_write_MAC_secret, exp + idx, sz); idx += sz;
     }
 #else
-    if (sz + idx > len) {
+    if ((sz * 2) + idx > len) {
         return BUFFER_E;
     }
     idx += sz; idx += sz;

Original file line number	Diff line number	Diff line change
`@@ -1169,7 +1169,7 @@ static int ImportKeyState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver,`
`1169`	`1169`	`XMEMCPY(keys->server_write_MAC_secret, exp + idx, sz); idx += sz;`
`1170`	`1170`	`}`
`1171`	`1171`	`#else`
`1172`		`- if (sz + idx > len) {`
	`1172`	`+ if ((sz * 2) + idx > len) {`
`1173`	`1173`	`return BUFFER_E;`
`1174`	`1174`	`}`
`1175`	`1175`	`idx += sz; idx += sz;`