From 266b96a53a0fcc8c93df25fac812b208774a6815 Mon Sep 17 00:00:00 2001
From: John Schanck <jschanck@mozilla.com>
Date: Wed, 24 Jan 2024 16:51:34 +0100
Subject: [PATCH] [NSS] add a defensive check for large ssl_DefSend return
 values.

---
 security/nss/lib/ssl/sslsecur.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/security/nss/lib/ssl/sslsecur.c b/security/nss/lib/ssl/sslsecur.c
index 14320fa190..fe6ea9ca32 100644
--- a/security/nss/lib/ssl/sslsecur.c
+++ b/security/nss/lib/ssl/sslsecur.c
@@ -441,7 +441,12 @@ ssl_SendSavedWriteData(sslSocket *ss)
         if (rv < 0) {
             return rv;
         }
-        ss->pendingBuf.len -= rv;
+        if (rv > ss->pendingBuf.len) {
+            PORT_Assert(0); /* This shouldn't happen */
+            ss->pendingBuf.len = 0;
+        } else {
+            ss->pendingBuf.len -= rv;
+        }
         if (ss->pendingBuf.len > 0 && rv > 0) {
             /* UGH !! This shifts the whole buffer down by copying it */
             PORT_Memmove(ss->pendingBuf.buf, ss->pendingBuf.buf + rv,