dtls13: add check over handshake message length

[rizlik]

No description provided.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[Copilot]

Pull request overview

Adds a DTLS 1.3 safety check to prevent buffering/reassembly of unauthenticated handshake fragments that claim an excessive message_length, and introduces a regression test to ensure oversized plaintext handshake messages are dropped rather than stored.

Changes:

• Add a MAX_HANDSHAKE_SZ cap check in src/dtls13.c before buffering handshake fragments for reassembly.
• Add a new DTLS 1.3 memio test that spoofs a plaintext ServerHello handshake message_length to exceed MAX_HANDSHAKE_SZ and asserts nothing is buffered.
• Register the new test in the DTLS API test declarations.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/api/test_dtls.h	Declares and registers the new DTLS 1.3 oversized handshake-length test.
tests/api/test_dtls.c	Adds a memio-based regression test that injects an oversized plaintext handshake fragment and checks it isn’t buffered.
src/dtls13.c	Caps DTLS 1.3 handshake messageLength prior to fragment buffering; drops oversized plaintext messages and errors on oversized encrypted ones.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.