Repository: dotnet/aspnetcore
File: src/Servers/Kestrel/Core/src/Middleware/TlsListener.cs (C#)

Code before:
                {
                    input.AdvanceTo(buffer.Start, buffer.End);
                }
                else
                {
                    // ready to continue middleware pipeline, reset the buffer to initial state
                    input.AdvanceTo(buffer.Start);
                }
            }
        }
    }

    /// <summary>
    /// RFCs
    /// ----
    /// TLS 1.1: https://datatracker.ietf.org/doc/html/rfc4346#section-6.2
    /// TLS 1.2: https://datatracker.ietf.org/doc/html/rfc5246#section-6.2
    /// TLS 1.3: https://datatracker.ietf.org/doc/html/rfc8446#section-5.1
    /// </summary>
    private static ClientHelloParseState TryParseClientHello(ReadOnlySequence<byte> buffer, ref short recordLength, out ReadOnlySequence<byte> clientHelloBytes)
    {
        clientHelloBytes = default;

        // in case bad actor will be sending a TLS client hello one byte at a time
        // and we know the expected length of TLS client hello,
        // we can check and fail fastly here instead of re-parsing the TLS client hello "header" on each iteration
        if (recordLength != -1 && buffer.Length < 5 + recordLength)
        {
            return ClientHelloParseState.NotEnoughData;
        }

        // this means we finally got a full tls record, so we can return without parsing again
        if (recordLength != -1)
        {
            clientHelloBytes = buffer.Slice(0, 5 + recordLength);
            return ClientHelloParseState.ValidTlsClientHello;
        }

        if (buffer.Length < 6)
        {
            return ClientHelloParseState.NotEnoughData;
        }

        var reader = new SequenceReader<byte>(buffer);

        // Content type must be 0x16 for TLS Handshake
        if (!reader.TryRead(out byte contentType) || contentType != 0x16)
        {
            return ClientHelloParseState.NotTlsClientHello;
        }


Review comment (bug):
```suggestion
        // we can check and fail quickly here instead of re-parsing the TLS client hello "header" on each iteration
```

Code after:
                {
                    input.AdvanceTo(buffer.Start, buffer.End);
                }
                else
                {
                    // ready to continue middleware pipeline, reset the buffer to initial state
                    input.AdvanceTo(buffer.Start);
                }
            }
        }
    }

    /// <summary>
    /// RFCs
    /// ----
    /// TLS 1.1: https://datatracker.ietf.org/doc/html/rfc4346#section-6.2
    /// TLS 1.2: https://datatracker.ietf.org/doc/html/rfc5246#section-6.2
    /// TLS 1.3: https://datatracker.ietf.org/doc/html/rfc8446#section-5.1
    /// </summary>
    private static ClientHelloParseState TryParseClientHello(ReadOnlySequence<byte> buffer, ref short recordLength, out ReadOnlySequence<byte> clientHelloBytes)
    {
        clientHelloBytes = default;

        // in case bad actor will be sending a TLS client hello one byte at a time
        // and we know the expected length of TLS client hello,
        // we can check and fail quickly here instead of re-parsing the TLS client hello "header" on each iteration
        if (recordLength != -1 && buffer.Length < 5 + recordLength)
        {
            return ClientHelloParseState.NotEnoughData;
        }

        // this means we finally got a full tls record, so we can return without parsing again
        if (recordLength != -1)
        {
            clientHelloBytes = buffer.Slice(0, 5 + recordLength);
            return ClientHelloParseState.ValidTlsClientHello;
        }

        if (buffer.Length < 6)
        {
            return ClientHelloParseState.NotEnoughData;
        }

        var reader = new SequenceReader<byte>(buffer);

        // Content type must be 0x16 for TLS Handshake
        if (!reader.TryRead(out byte contentType) || contentType != 0x16)
        {
            return ClientHelloParseState.NotTlsClientHello;
        }