QUIC WIRE: RFC 9000 s. 19.6

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21547)

diff --git a/ssl/quic/quic_wire.c b/ssl/quic/quic_wire.c
index 4b50f5984b6cc7a85e69a18ae8b641ef17011710..7ad7f8b44200d29959e08aadda7548f1c6f01a94 100644 (file)
--- a/ssl/quic/quic_wire.c
+++ b/ssl/quic/quic_wire.c
@@ -618,6 +618,10 @@ int ossl_quic_wire_decode_frame_crypto(PACKET *pkt,
             || f->len > SIZE_MAX /* sizeof(uint64_t) > sizeof(size_t)? */)
         return 0;
 
+    if (f->offset + f->len > (((uint64_t)1) << 62) - 1)
+        /* RFC 9000 s. 19.6 */
+        return 0;
+
     if (nodata) {
         f->data = NULL;
     } else {