diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2015-01-03 00:45:13 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2015-01-08 13:43:20 +0000 |
| commit | 8d7aab986b499f34d9e1bc58fbfd77f05c38116e (patch) | |
| tree | af141717443c3028fcf16157fcfcaf3b0339fcad | |
| parent | e078642ddea29bbb6ba29788a6a513796387fbbb (diff) | |
Fix crash in dtls1_get_record whilst in the listen state where you get two
separate reads performed - one for the header and one for the body of the
handshake record.
CVE-2014-3571
Reviewed-by: Matt Caswell <matt@openssl.org>
| -rw-r--r-- | ssl/d1_pkt.c | 2 | ||||
| -rw-r--r-- | ssl/s3_pkt.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index edd17df54b..d717260313 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -642,8 +642,6 @@ again: /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */ i=rr->length; n=ssl3_read_n(s,i,i,1); - if (n <= 0) return(n); /* error or non-blocking io */ - /* this packet contained a partial record, dump it */ if ( n != i) { diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index d1cd752209..1ec9e6ea46 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -183,6 +183,8 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) * at once (as long as it fits into the buffer). */ if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER) { + if (left == 0 && extend) + return 0; if (left > 0 && n > left) n = left; } |