Commit b8d24395 authored by Matt Caswell's avatar Matt Caswell
Browse files

Fix a hang with SSL_peek() 



If while calling SSL_peek() we read an empty record then we go into an
infinite loop, continually trying to read data from the empty record and
never making any progress. This could be exploited by a malicious peer in
a Denial Of Service attack.

CVE-2016-6305

GitHub Issue #1563

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent c31dbed7

ssl/record/rec_layer_s3.c

+5 −1
Original line number Diff line number Diff line
@@ -1133,7 +1133,11 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf, 


            memcpy(buf, &(rr->data[rr->off]), n);

            buf += n;

            if (!peek) {

            if (peek) {

                /* Mark any zero length record as consumed CVE-2016-6305 */

                if (SSL3_RECORD_get_length(rr) == 0)

                    SSL3_RECORD_set_read(rr);

            } else {

                SSL3_RECORD_sub_length(rr, n);

                SSL3_RECORD_add_off(rr, n);

                if (SSL3_RECORD_get_length(rr) == 0) {