Improve DTLS bucket logic

[julek-wolfssl]

ZD21421

Tested by @Sebasteuo

[Copilot]

Pull request overview

This PR updates DTLS handshake fragment “bucket” handling to correctly manage gap insertion and overlap merging, and strengthens regression coverage by expanding the DTLS fragment bucket API tests.

Changes:

• Fix fragment merge copy logic when new data overlaps an existing bucket so the non-overlapped tail is copied from the correct offset.
• Adjust DTLS fragment insertion logic to allow inserting a disjoint fragment before cur even when it’s not the first bucket (gap between buckets).
• Refactor/extend DTLS fragment bucket tests to use the EXPECT_* harness and add more edge-case scenarios.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/internal.c	Fixes DTLS fragment bucket combine/insertion logic (overlap copy offset; gap insertion between buckets).
tests/api.c	Refactors DTLS fragment bucket tests to EXPECT_* and adds additional scenarios for the updated bucket logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[programsurf]

Both fixes look correct. The XMEMMOVE source-pointer fix (7e5f607) and the gap-insertion generalization (3907dbd) address the two root causes.

Test sequence 11 covers the same vulnerability pattern from our report — good coverage.

One defense-in-depth note: the else if (fragOffset <= curEnd) condition in the for loop (line 9838) still doesn't verify that the fragment actually overlaps cur. Currently safe because the new fragOffsetEnd < cur->m.m.offset branch catches disjoint fragments first, but adding && fragOffsetEnd >= cur->m.m.offset there would guard against future branch reordering.

[julek-wolfssl]

One defense-in-depth note: the else if (fragOffset <= curEnd) condition in the for loop (line 9838) still doesn't verify that the fragment actually overlaps cur. Currently safe because the new fragOffsetEnd < cur->m.m.offset branch catches disjoint fragments first, but adding && fragOffsetEnd >= cur->m.m.offset there would guard against future branch reordering.

That check looks for a place to place the new bucket. It doesn't check for overlap.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[julek-wolfssl]

retest this please history lost..

[julek-wolfssl]

retest this please unrelated errors