Eclipse tinydtls out-of-bounds read in check_server_certificate() DTLS handshake parser

#!/usr/bin/env bash
# check-tinydtls.sh — detect Eclipse tinydtls pre-b3efd41 in a source tree
# Usage: ./check-tinydtls.sh <path-to-source-tree>
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN/NOT FOUND
set -u

ROOT="${1:-.}"
FIX_COMMIT="b3efd41ad111a4920f599f51ffa4f5e9f1e72221"
FIX_SHORT="b3efd41"

if [[ ! -d "$ROOT" ]]; then
  echo "UNKNOWN: $ROOT is not a directory"
  exit 2
fi

# Find candidate tinydtls trees (dtls.c + dtls.h colocated)
mapfile -t HITS < <(find "$ROOT" -type f -name dtls.c 2>/dev/null | while read -r f; do
  d=$(dirname "$f")
  [[ -f "$d/dtls.h" && -f "$d/peer.c" ]] && echo "$d"
done)

if [[ ${#HITS[@]} -eq 0 ]]; then
  echo "UNKNOWN: no tinydtls source tree found under $ROOT"
  exit 2
fi

STATUS=0
for d in "${HITS[@]}"; do
  echo "[*] tinydtls candidate: $d"
  if [[ -d "$d/.git" || -f "$d/.git" ]]; then
    if git -C "$d" merge-base --is-ancestor "$FIX_COMMIT" HEAD 2>/dev/null; then
      echo "    PATCHED (fix $FIX_SHORT is ancestor of HEAD)"
    else
      echo "    VULNERABLE (fix $FIX_SHORT not in history)"
      STATUS=1
    fi
  else
    # No git metadata — fall back to source-level fingerprint of the fix
    if grep -qE 'check_server_certificate' "$d/dtls.c"; then
      # Heuristic: the post-fix code adds an explicit length-bound check before ECDSA parse
      if grep -qE 'data_length\s*<\s*sizeof.*ecdsa|bounds.*server.*cert' "$d/dtls.c"; then
        echo "    LIKELY PATCHED (bounds check present)"
      else
        echo "    LIKELY VULNERABLE (no post-fix bounds check fingerprint)"
        STATUS=1
      fi
    else
      echo "    UNKNOWN (check_server_certificate symbol missing — atypical fork)"
      [[ $STATUS -eq 0 ]] && STATUS=2
    fi
  fi
done

case $STATUS in
  0) echo "RESULT: PATCHED";;
  1) echo "RESULT: VULNERABLE";;
  2) echo "RESULT: UNKNOWN";;
esac
exit $STATUS