Fix off-by-one in length check.

Spotted by jsing

diff --git a/lib/libssl/t1_lib.c b/lib/libssl/t1_lib.c
index 1dca305..9748901 100644 (file)
--- a/lib/libssl/t1_lib.c
+++ b/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.189 2022/07/02 09:33:20 tb Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.190 2022/07/02 15:53:37 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -340,7 +340,7 @@ tls1_ec_curve_id2nid(const uint16_t curve_id)
 
        /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
        if ((curve_id < 1) ||
-           ((unsigned int)curve_id > sizeof(nid_list) / sizeof(nid_list[0])))
+           ((unsigned int)curve_id >= sizeof(nid_list) / sizeof(nid_list[0])))
                return NID_undef;
 
        if ((curve = &nid_list[curve_id]) == NULL)
@@ -355,7 +355,7 @@ tls1_ec_curve_id2bits(const uint16_t curve_id)
        const struct curve *curve;
 
        if ((curve_id < 1) ||
-           ((unsigned int)curve_id > sizeof(nid_list) / sizeof(nid_list[0])))
+           ((unsigned int)curve_id >= sizeof(nid_list) / sizeof(nid_list[0])))
                return 0;
 
        if ((curve = &nid_list[curve_id]) == NULL)