From: Matthew Endsley <mendsley@gmail.com>
Date: Wed, 31 Mar 2021 19:02:49 +0000 (-0700)
Subject: Drop records that are too small to be decrypted
X-Git-Tag: 1.0.0~12^2~1
X-Git-Url: https://git.deb.at/?a=commitdiff_plain;h=9f39f6a175ddec28afbda44867378d1c43a07ef1;p=rhonda%2Fimpostor.hazel.git

Drop records that are too small to be decrypted
---

diff --git a/Hazel/Dtls/DtlsConnectionListener.cs b/Hazel/Dtls/DtlsConnectionListener.cs
index 32c7835..69d01aa 100644
--- a/Hazel/Dtls/DtlsConnectionListener.cs
+++ b/Hazel/Dtls/DtlsConnectionListener.cs
@@ -358,6 +358,12 @@ namespace Hazel.Dtls
 
                     // Validate record authenticity
                     int decryptedSize = peer.CurrentEpoch.RecordProtection.GetDecryptedSize(recordPayload.Length);
+                    if (decryptedSize < 0)
+                    {
+                        this.Logger.WriteInfo($"Dropping malformed record: Length {recordPayload.Length} Decrypted length: {decryptedSize}");
+                        continue;
+                    }
+
                     ByteSpan decryptedPayload = recordPayload.ReuseSpanIfPossible(decryptedSize);
 
                     if (!peer.CurrentEpoch.RecordProtection.DecryptCiphertextFromClient(decryptedPayload, recordPayload, ref record))