Bounds check in ssl_parse_certificate_request() too strict

[hanno-becker]

Summary: PR #1663 modified a bounds check in ssl_parse_certificate_request() which was correct beforehand and now off by one, leading to rejection of valid CertificateRequest messages.

    if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
    {
        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
        ...
    }

this should be

    if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
    {
        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
        ...
    }

Steps to reproduce provided by @mpg, from within MBEDTLS_DIR/tests:

• Server: gnutls-serv --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key
• Client: ../programs/ssl/ssl_client2 server_port=5556 force_version=tls1_1

[ciarmcom]

ARM Internal Ref: IOTSSL-2479