QUIC WIRE: Refuse integer transport params with trailing body bytes

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22523)

diff --git a/ssl/quic/quic_wire.c b/ssl/quic/quic_wire.c
index 6f8da05124b6f98534d58c981f0e7810e2aff378..425e7efc2ede631679ea11a49c8adc08a05dd46f 100644 (file)
--- a/ssl/quic/quic_wire.c
+++ b/ssl/quic/quic_wire.c
@@ -950,6 +950,9 @@ int ossl_quic_wire_decode_transport_param_int(PACKET *pkt,
     if (!PACKET_get_quic_vlint(&sub, value))
         return 0;
 
+    if (PACKET_remaining(&sub) > 0)
+        return 0;
+
    return 1;
 }