On Fri, 30 Oct 2026 08:30:38 GMT, Daniel Jeliński <[email protected]> wrote:
>> Timofei Fedotov has updated the pull request incrementally with two
>> additional commits since the last revision:
>>
>> - Add number of bug in test
>> - Add test
>
> src/java.base/share/classes/sun/security/ssl/DTLSInputRecord.java line 691:
>
>> 689:
>> 690: // All fragments of one message must agree on its total
>> length.
>> 691: for (RecordFragment fragment : bufferedFragments) {
>
> We should avoid scanning the entire list of already-buffered fragments; it
> could be abused by a malicious peer. Could you store the expected message
> length somewhere instead? `holesMap` could be the right place.
Done.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/33633#discussion_r4422566485
