Fix end check before memmove

Signed-off-by: Gilles Peskine <[email protected]>

library/ssl_msg.c

@@ -3377,7 +3377,7 @@ int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl)
 #else
         size_t const in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
 #endif
-        if (payload_end + ssl->badmac_seen_or_in_hsfraglen > ssl->in_buf + in_buf_len) {
+        if (payload_end + ssl->in_msglen > ssl->in_buf + in_buf_len) {
             MBEDTLS_SSL_DEBUG_MSG(1,
                                   ("Shouldn't happen: no room to move handshake fragment %"
                                    MBEDTLS_PRINTF_SIZET " from %p to %p (buf=%p len=%"