fix(tls): bound PSK identity length before decrypt

[alanhoff]

Summary

• reject oversized TLS 1.3 PSK ticket identities before copying or decrypting them into fixed-size stack buffers
• keep invalid oversized identities on the normal PSK rejection path instead of letting them reach @memcpy/AEAD output slices
• add a regression test that feeds an oversized PSK identity directly into tryProcessPsk

Vulnerability

tryProcessPsk reads identity_len from the client-controlled pre_shared_key extension, then copies that identity into an 80-byte stack buffer and decrypts it into a 64-byte stack buffer without first proving the length fits. A malicious client can keep the extension internally well-formed while choosing an identity length that exceeds those buffers.

Concrete examples:

• an identity_len of 81 bytes stays extension-valid, but it drives ciphertext_len to 65, which exceeds the 64-byte plaintext buffer
• a larger identity such as 96 bytes would overrun both the 80-byte ticket buffer and the decrypt output slice
• because this runs on the server's network-facing ClientHello path, a hostile client can repeatedly trigger remote crashes and, in unchecked builds, memory corruption

Validation

• zig build test
• zig build
• zig build fuzz

References

• RFC 8446 section 4.2.11: https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.11
• RFC 8446 section 7.1: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1
• QUIC TLS mapping in RFC 9001 section 4: https://datatracker.ietf.org/doc/html/rfc9001#section-4

[Copilot]

Pull request overview

This PR hardens the QUIC TLS 1.3 server-side PSK resumption path by rejecting oversized PSK ticket identities before they can be copied/decrypted into fixed-size stack buffers, and adds a regression test to ensure the oversized case is handled safely.

Changes:

• Add explicit upper bounds for identity_len/ciphertext_len in tryProcessPsk before any @memcpy or AEAD decrypt output slicing.
• Keep oversized identities on the normal PSK rejection path (early return; using_psk remains false).
• Add a unit test that feeds an oversized PSK identity directly into tryProcessPsk.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.