Merge pull request #622 from falemagn/pull-reqs/fix-buffer-issue-in-D…

…oReceive Update the buffer's index in DoReceive() any time the buffer's index is updated in DoPacket().
wolfSSL · Dec 5, 2023 · 7892d65 · 7892d65
2 parents 086cb8e + 205cec1
commit 7892d65
Showing 1 changed file with 16 additions and 8 deletions.
diff --git a/src/internal.c b/src/internal.c
@@ -7487,7 +7487,7 @@ static int DoChannelExtendedData(WOLFSSH* ssh,
 }
 
 
-static int DoPacket(WOLFSSH* ssh)
+static int DoPacket(WOLFSSH* ssh, byte* bufferConsumed)
 {
     byte* buf = (byte*)ssh->inputBuffer.buffer;
     word32 idx = ssh->inputBuffer.idx;
@@ -7500,6 +7500,8 @@ static int DoPacket(WOLFSSH* ssh)
 
     WLOG(WS_LOG_DEBUG, "DoPacket sequence number: %d", ssh->peerSeq);
 
+    *bufferConsumed = 0;
+
     idx += UINT32_SZ;
     padSz = buf[idx++];
 
@@ -7727,6 +7729,7 @@ static int DoPacket(WOLFSSH* ssh)
     idx += padSz;
     ssh->inputBuffer.idx = idx;
     ssh->peerSeq++;
+    *bufferConsumed = 1;
 
     return ret;
 }
@@ -8115,6 +8118,7 @@ int DoReceive(WOLFSSH* ssh)
     byte peerBlockSz = ssh->peerBlockSz;
     byte peerMacSz = ssh->peerMacSz;
     byte aeadMode = ssh->peerAeadMode;
+    byte bufferConsumed = 0;
 
     switch (ssh->processReplyState) {
         case PROCESS_INIT:
@@ -8221,25 +8225,29 @@ int DoReceive(WOLFSSH* ssh)
             NO_BREAK;
 
         case PROCESS_PACKET:
-            ret = DoPacket(ssh);
+            ret = DoPacket(ssh, &bufferConsumed);
             ssh->error = ret;
             if (ret < 0 && !(ret == WS_CHAN_RXD || ret == WS_EXTDATA ||
                     ret == WS_CHANNEL_CLOSED || ret == WS_WANT_WRITE ||
                     ret == WS_REKEYING || ret == WS_WANT_READ)) {
-                return WS_FATAL_ERROR;
+                ret = WS_FATAL_ERROR;
             }
-            WLOG(WS_LOG_DEBUG, "PR3: peerMacSz = %u", peerMacSz);
-            ssh->inputBuffer.idx += peerMacSz;
             break;
 
         default:
             WLOG(WS_LOG_DEBUG, "Bad process input state, program error");
             ssh->error = WS_INPUT_CASE_E;
             return WS_FATAL_ERROR;
     }
-    WLOG(WS_LOG_DEBUG, "PR4: Shrinking input buffer");
-    ShrinkBuffer(&ssh->inputBuffer, 1);
-    ssh->processReplyState = PROCESS_INIT;
+
+    if (bufferConsumed) {
+        WLOG(WS_LOG_DEBUG, "PR3: peerMacSz = %u", peerMacSz);
+        ssh->inputBuffer.idx += peerMacSz;
+
+        WLOG(WS_LOG_DEBUG, "PR4: Shrinking input buffer");
+        ShrinkBuffer(&ssh->inputBuffer, 1);
+        ssh->processReplyState = PROCESS_INIT;
+    }
 
     WLOG(WS_LOG_DEBUG, "PR5: txCount = %u, rxCount = %u",
          ssh->txCount, ssh->rxCount);