Commit 9fe4603b authored by David Woodhouse's avatar David Woodhouse Committed by Dr. Stephen Henson
Browse files

Check DTLS_BAD_VER for version number. 

The version check for DTLS1_VERSION was redundant as
DTLS1_VERSION > TLS1_1_VERSION, however we do need to
check for DTLS1_BAD_VER for compatibility.

PR:2984
(cherry picked from commit d980abb2)
parent 147dbb2f

ssl/s3_cbc.c

+1 −1
Original line number Diff line number Diff line
@@ -148,7 +148,7 @@ int tls1_cbc_remove_padding(const SSL* s, 
	unsigned padding_length, good, to_check, i;

	const unsigned overhead = 1 /* padding length byte */ + mac_size;

	/* Check if version requires explicit IV */

	if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION)

	if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER)

		{

		/* These lengths are all public so we can test them in

		 * non-constant time.