rebased curl/nginx & issue from curl CI

esnistuff/README.md

@@ -22,11 +22,16 @@ Most recent first...
 
 DON'T DEPLOY ECH YET!!! It's still work-in-progress code.
 
-- 20231203: fixed issue with GREASE+HRR, rebased apaceh, haproxy, nginx, lighttpd 
-  (in recent days), started moving ``esnistuff`` content to a new defo-project]
-[ech-dev-utils](https://github.com/defo-project/ech-dev-utils) repo, as stuff
-from here won't be part of our (soon upcoming!) ECH PR to upstream openssl.
-(Also refactoring howtos and test configs/scripts over there quite a bit.)
+- 20240113: Rebased curl
+
+- 20240110: Rebased nginx again.
+
+- 20231203: fixed issue with GREASE+HRR, rebased apache, haproxy, nginx,
+  lighttpd (in recent days), started moving ``esnistuff`` content to a new
+defo-project] [ech-dev-utils](https://github.com/defo-project/ech-dev-utils)
+repo, as stuff from here won't be part of our (soon upcoming!) ECH PR to
+upstream openssl.  (Also refactoring howtos and test configs/scripts over there
+quite a bit.)
 
 - 20231120: changes to constants related to early IANA codepoint allocation
 
@@ -35,7 +40,7 @@ from here won't be part of our (soon upcoming!) ECH PR to upstream openssl.
 - 20231113: rebased again
 
 - 20231030: rebased again and cleaned up some of the gratuituous differences
-  between this and the ``masster`` branch, including:
+  between this and the ``master`` branch, including:
     - ``crypto/err/openssl.txt`` had some gratuituous differences that are
       probably merge hangovers
     - repetition of ``hpke`` in ``crypto/build.info``

ssl/ech.c

@@ -390,13 +390,13 @@ static int local_decode_rdata_name(unsigned char **buf, size_t *remaining,
                                    char **dnsname)
 {
     unsigned char *cp = NULL;
-    size_t rem = 0;
+    int rem = 0;
     char *thename = NULL, *tp = NULL;
     unsigned char clen = 0; /* chunk len */
 
     if (buf == NULL || remaining == NULL || dnsname == NULL)
         return 0;
-    rem = *remaining;
+    rem = (int)*remaining;
     thename = OPENSSL_malloc(TLSEXT_MAXLEN_host_name);
     if (thename == NULL)
         return 0;
@@ -423,9 +423,17 @@ static int local_decode_rdata_name(unsigned char **buf, size_t *remaining,
         *tp++ = '.';
         cp += clen;
         rem -= (clen + 1);
+        if (rem <= 0) {
+            OPENSSL_free(thename);
+            return 0;
+        }
         clen = *cp++;
     }
     *buf = cp;
+    if (rem <= 0) {
+        OPENSSL_free(thename);
+        return 0;
+    }
     *remaining = rem;
     *dnsname = thename;
     return 1;