Commit b4322e1d authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Fix CVE-2014-0221 

Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without recursion.

Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
(cherry picked from commit d3152655d5319ce883c8e3ac4b99f8de4c59d846)
parent a5362db4

ssl/d1_both.c

+2 −2
Original line number Diff line number Diff line
@@ -789,6 +789,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok) 
	int i,al;

	struct hm_header_st msg_hdr;



	redo:

	/* see if we have the required fragment already */

	if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)

		{
@@ -847,8 +848,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok) 
					s->msg_callback_arg);

			

			s->init_num = 0;

			return dtls1_get_message_fragment(s, st1, stn,

				max, ok);

			goto redo;

			}

		else /* Incorrectly formated Hello request */

			{