Merge pull request #9418 from SparkiDev/tls13_ks_dup_check_fix

dgarske · web-flow · commit 5a8411a1ada3 · 2025-11-12T16:09:11.000-08:00
TLS 1.3 duplicate KeyShare entry fix
diff --git a/src/tls.c b/src/tls.c
@@ -9830,7 +9830,7 @@ static int TLSX_KeyShareEntry_Parse(const WOLFSSL* ssl, const byte* input,
         return BUFFER_ERROR;
 
     if (seenGroups != NULL) {
-        if (*seenGroupsCnt == MAX_KEYSHARE_NAMED_GROUPS) {
+        if (*seenGroupsCnt >= MAX_KEYSHARE_NAMED_GROUPS) {
             return BAD_KEY_SHARE_DATA;
         }
         for (i = 0; i < *seenGroupsCnt; i++) {

Original file line number	Diff line number	Diff line change
`@@ -9830,7 +9830,7 @@ static int TLSX_KeyShareEntry_Parse(const WOLFSSL* ssl, const byte* input,`
`9830`	`9830`	`return BUFFER_ERROR;`
`9831`	`9831`
`9832`	`9832`	`if (seenGroups != NULL) {`
`9833`		`- if (*seenGroupsCnt == MAX_KEYSHARE_NAMED_GROUPS) {`
	`9833`	`+ if (*seenGroupsCnt >= MAX_KEYSHARE_NAMED_GROUPS) {`
`9834`	`9834`	`return BAD_KEY_SHARE_DATA;`
`9835`	`9835`	`}`
`9836`	`9836`	`for (i = 0; i < *seenGroupsCnt; i++) {`