From 9f39f6a175ddec28afbda44867378d1c43a07ef1 Mon Sep 17 00:00:00 2001
From: Matthew Endsley <mendsley@gmail.com>
Date: Wed, 31 Mar 2021 12:02:49 -0700
Subject: [PATCH] Drop records that are too small to be decrypted

---
 Hazel/Dtls/DtlsConnectionListener.cs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Hazel/Dtls/DtlsConnectionListener.cs b/Hazel/Dtls/DtlsConnectionListener.cs
index 32c7835..69d01aa 100644
--- a/Hazel/Dtls/DtlsConnectionListener.cs
+++ b/Hazel/Dtls/DtlsConnectionListener.cs
@@ -358,6 +358,12 @@ namespace Hazel.Dtls
 
                     // Validate record authenticity
                     int decryptedSize = peer.CurrentEpoch.RecordProtection.GetDecryptedSize(recordPayload.Length);
+                    if (decryptedSize < 0)
+                    {
+                        this.Logger.WriteInfo($"Dropping malformed record: Length {recordPayload.Length} Decrypted length: {decryptedSize}");
+                        continue;
+                    }
+
                     ByteSpan decryptedPayload = recordPayload.ReuseSpanIfPossible(decryptedSize);
 
                     if (!peer.CurrentEpoch.RecordProtection.DecryptCiphertextFromClient(decryptedPayload, recordPayload, ref record))
-- 
2.39.5