Commit 7ff33de472 for openssl.org

commit 7ff33de472e0550159e330753558cb77666bc57b
Author: Norbert Pocs <norbertp@openssl.org>
Date:   Thu Sep 3 09:35:23 2026 +0200

    Fix wrong condition evaluation order

    The OR has precedence therefore the code can fall over when dtls
    has a 0 lenght record.

    The condition evaluated as `(a || b) ? c : d`.

    Fixes coverity issue 1700556.

    Signed-off-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Merge-date: Thu Sep 17 16:51:01 2026
    Merged-from: https://github.com/openssl/openssl/pull/32666

diff --git a/ssl/record/methods/tls13_meth.c b/ssl/record/methods/tls13_meth.c
index 1bd6437d23..8fea9f7292 100644
--- a/ssl/record/methods/tls13_meth.c
+++ b/ssl/record/methods/tls13_meth.c
@@ -347,9 +347,9 @@ static int tls13_post_process_record(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
         size_t end;

         if (rec->length == 0
-                    || rl->isdtls
-                ? !DTLS13_UNI_HDR_FIX_BITS_IS_SET(rec->type)
-                : rec->type != SSL3_RT_APPLICATION_DATA) {
+            || (rl->isdtls
+                    ? !DTLS13_UNI_HDR_FIX_BITS_IS_SET(rec->type)
+                    : rec->type != SSL3_RT_APPLICATION_DATA)) {
             RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,
                 SSL_R_BAD_RECORD_TYPE);
             return 0;