Rework check to compare only ints.

kareem-wolfssl · kareem-wolfssl · commit 94b370f5e2a5 · 2026-03-13T11:42:12.000-07:00
diff --git a/src/sniffer.c b/src/sniffer.c
@@ -5521,7 +5521,7 @@ static int CheckHeaders(IpInfo* ipInfo, TcpInfo* tcpInfo, const byte* packet,
     *sslBytes = (int)(packet + ipInfo->total - *sslFrame);
 
     /* Ensure sslBytes does not exceed the actual size. */
-    if (*sslBytes > (int)(length - (*sslFrame - packet))) {
+    if (*sslBytes > (int)(length - (ipInfo->length + tcpInfo->length))) {
         SetError(PACKET_HDR_SHORT_STR, error, NULL, 0);
         return WOLFSSL_FATAL_ERROR;
     }

Original file line number	Diff line number	Diff line change
`@@ -5521,7 +5521,7 @@ static int CheckHeaders(IpInfo* ipInfo, TcpInfo* tcpInfo, const byte* packet,`
`5521`	`5521`	`sslBytes = (int)(packet + ipInfo->total - sslFrame);`
`5522`	`5522`
`5523`	`5523`	`/* Ensure sslBytes does not exceed the actual size. */`
`5524`		`- if (sslBytes > (int)(length - (sslFrame - packet))) {`
	`5524`	`+ if (*sslBytes > (int)(length - (ipInfo->length + tcpInfo->length))) {`
`5525`	`5525`	`SetError(PACKET_HDR_SHORT_STR, error, NULL, 0);`
`5526`	`5526`	`return WOLFSSL_FATAL_ERROR;`
`5527`	`5527`	`}`