A common idiom in the codebase is:
if (p + len > limit)
{
return; /* Too long */
}
where p points to some malloc'd data of SIZE bytes and limit == p + SIZE. 'len' could be from some externally supplied data, e.g. TLS message. This idiom is vulnerable to integer overflow vulnerability.
Upstream commit: 6f35f6deb5ca7daebe289f86477e061ce3ee5f46
