From 08e3e3f81e6c5703c3afcbfcb47c600a2b10afcb Mon Sep 17 00:00:00 2001
From: Ben Taylor <ben.taylor@linaro.org>
Date: Mon, 11 May 2026 15:22:09 +0100
Subject: [PATCH] Add fix for OOB key exchange error

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
---
 library/ssl_tls12_client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c
index a0170d51f6..d32fea18c1 100644
--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
@@ -1885,6 +1885,8 @@ start_processing:
          * However since we only support secp256r1 for now, we check only
          * that TLS ID here
          */
+        MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3);
+
         uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1);
         uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
             MBEDTLS_ECP_DP_SECP256R1);