Commit 46bf0ba8 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson Committed by Matt Caswell
Browse files

Fix crash in dtls1_get_record whilst in the listen state where you get two 


separate reads performed - one for the header and one for the body of the
handshake record.

CVE-2014-3571

Reviewed-by: default avatarMatt Caswell <matt@openssl.org>

Conflicts:
	ssl/s3_pkt.c
parent 4b4c0a19

ssl/d1_pkt.c

+0 −2
Original line number Diff line number Diff line
@@ -595,8 +595,6 @@ again: 
		/* now s->packet_length == DTLS1_RT_HEADER_LENGTH */

		i=rr->length;

		n=ssl3_read_n(s,i,i,1);

		if (n <= 0) return(n); /* error or non-blocking io */



		/* this packet contained a partial record, dump it */

		if ( n != i)

			{

ssl/s3_pkt.c

+2 −0
Original line number Diff line number Diff line
@@ -147,6 +147,8 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) 
	 * at once (as long as it fits into the buffer). */

	if (SSL_version(s) == DTLS1_VERSION)

		{

		if (s->s3->rbuf.left == 0 && extend)

			return 0;

		if ( s->s3->rbuf.left > 0 && n > s->s3->rbuf.left)

			n = s->s3->rbuf.left;

		}