Commit 6ce9687b authored by Kurt Roeckx's avatar Kurt Roeckx
Browse files

Keep old method in case of an unsupported protocol 



When we're configured with no-ssl3 and we receive an SSL v3 Client Hello, we set
the method to NULL.  We didn't used to do that, and it breaks things.  This is a
regression introduced in 62f45cc2.  Keep the old
method since the code is not able to deal with a NULL method at this time.

CVE-2014-3569, PR#3571

Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>
(cherry picked from commit 392fa7a9)
parent 20e61058

ssl/s23_srvr.c

+4 −2
Original line number Diff line number Diff line
@@ -602,12 +602,14 @@ int ssl23_get_client_hello(SSL *s) 
	if ((type == 2) || (type == 3))

		{

		/* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */

                s->method = ssl23_get_server_method(s->version);

		if (s->method == NULL)

		const SSL_METHOD *new_method;

		new_method = ssl23_get_server_method(s->version);

		if (new_method == NULL)

			{

			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);

			goto err;

			}

		s->method = new_method;



		if (!ssl_init_wbio_buffer(s,1)) goto err;