fixup! ProcessServerHello: verify extension lengths

julek-wolfssl · julek-wolfssl · commit afed9d4b7990 · 2026-03-10T09:52:06.000+01:00
diff --git a/src/sniffer.c b/src/sniffer.c
@@ -3867,7 +3867,7 @@ static int ProcessServerHello(int msgSz, const byte* input, int* sslBytes,
             }
         #endif
             case EXT_SUPPORTED_VERSIONS:
-                if (extLen < 2) {
+                if (extLen != 2) {
                     SetError(SERVER_HELLO_INPUT_STR, error, session,
                              FATAL_ERROR_STATE);
                     return WOLFSSL_FATAL_ERROR;

Original file line number	Diff line number	Diff line change
`@@ -3867,7 +3867,7 @@ static int ProcessServerHello(int msgSz, const byte* input, int* sslBytes,`
`3867`	`3867`	`}`
`3868`	`3868`	`#endif`
`3869`	`3869`	`case EXT_SUPPORTED_VERSIONS:`
`3870`		`- if (extLen < 2) {`
	`3870`	`+ if (extLen != 2) {`
`3871`	`3871`	`SetError(SERVER_HELLO_INPUT_STR, error, session,`
`3872`	`3872`	`FATAL_ERROR_STATE);`
`3873`	`3873`	`return WOLFSSL_FATAL_ERROR;`