If the maximum fragment extension was negotiated, enforce it. Also

enforce the 2^14 byte plaintext limit in the reader (previously only
the 2^14+2048 byte ciphertext size limit was enforced).

1 files changed, 6 insertions, 0 deletions

diff --git a/src/tls/tls_server.cpp b/src/tls/tls_server.cpp
index 17f2b51b9..e66936771 100644
--- a/src/tls/tls_server.cpp
+++ b/src/tls/tls_server.cpp
@@ -200,7 +200,10 @@ void TLS_Server::process_handshake_msg(Handshake_Type type,
             rng);
 
          if(session_info.fragment_size())
+            {
+            reader.set_maximum_fragment_size(session_info.fragment_size());
             writer.set_maximum_fragment_size(session_info.fragment_size());
+            }
 
          state->suite = TLS_Cipher_Suite(state->server_hello->ciphersuite());
 
@@ -250,7 +253,10 @@ void TLS_Server::process_handshake_msg(Handshake_Type type,
             rng);
 
          if(state->client_hello->fragment_size())
+            {
+            reader.set_maximum_fragment_size(state->client_hello->fragment_size());
             writer.set_maximum_fragment_size(state->client_hello->fragment_size());
+            }
 
          state->suite = TLS_Cipher_Suite(state->server_hello->ciphersuite());