dtls.c: fix length check in check_server_certificate.

[boaks]

Fixes potential out-of-bounds read.

[boaks]

@obgm

Please a fast LGTM, thanks!

[obgm]

Looks good in general but I think this check should come before doing the update_hs_hash in line 3433 .

Otherwise, LGTM.

[boaks]

Done.

[wsparks-vc]

Hello @boaks and @obgm - does the Eclipse Foundation CNA intend to assign a CVE for the reported vulnerability?

[boaks]

From the team's (obgm an me) view, tinydtls is in development stage. We have no 1.0 release.
I personally don't know, if we find enough "volunteer time", at least I'm not longer able to spend that larger amount of time.
Therefor we also decided two years ago, just to fix vulnerabilities (if possible with the time we#re able to spend), but don't go for CVE reporting. It's just really a question of work-time.

[wsparks-vc]

It's standard practice in vuln management to issue CVEs to public patches, rather than waiting for an official release. Through managing the VulnCheck CVE Numbering Authoring (CNA), I usually work with maintainers to allow for official version releases to be put together prior to CVE publication. Since the Eclipse Foundation would, presumably, be the CNA with appropriate first-level scope, we'd like to push for CVE issuance ASAP.