additional sanity check with session ticket size

[JacobBarthelmeh]

ZD21281

[Copilot]

Pull request overview

Adds an additional bounds check when parsing/decrypting TLS 1.2 session tickets to ensure the encrypted-length field cannot exceed the actual received ticket buffer size, and introduces a regression test that tampers with enc_len to validate the sanity check.

Changes:

• Add a length validation in DoDecryptTicket() to reject tickets where enc_len + fixed_overhead > total_ticket_len.
• Add a TLS 1.2 memio regression test that generates a valid ticket, corrupts enc_len, and attempts resumption.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
tests/api.c	Adds test_ticket_enc_corrupted to exercise corrupted enc_len handling during TLS 1.2 ticket resumption.
src/internal.c	Adds a sanity check preventing out-of-bounds access when enc_len exceeds the available ticket buffer.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.