CID444418. Fix for finishSz checking with TLSv1.3 and `WOLFSSL_HAVE_T…

…LS_UNIQUE`.
wolfSSL · Dec 24, 2024 · e1baf27 · e1baf27
1 parent 2bcad98
commit e1baf27
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/src/tls13.c b/src/tls13.c
@@ -10865,12 +10865,12 @@ int DoTls13Finished(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
     }
 
     if (sniff == NO_SNIFF) {
-        ret = BuildTls13HandshakeHmac(ssl, secret, mac, &finishedSz);
 
-        if (finishedSz > WOLFSSL_MAX_8BIT) {
+        ret = BuildTls13HandshakeHmac(ssl, secret, mac, &finishedSz);
+    #ifdef WOLFSSL_HAVE_TLS_UNIQUE
+        if (finishedSz > TLS_FINISHED_SZ_MAX) {
             return BUFFER_ERROR;
         }
-    #ifdef WOLFSSL_HAVE_TLS_UNIQUE
         if (ssl->options.side == WOLFSSL_CLIENT_END) {
             XMEMCPY(ssl->serverFinished, mac, finishedSz);
             ssl->serverFinished_len = (byte)finishedSz;