diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2009-05-18 17:37:33 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2009-05-18 17:37:33 +0000 |
commit | d0b72cf45be9d69db73e840457f0475cc7d0a53a (patch) | |
tree | 8edbee7c150cc33ec6170c37a269441d4e760fd4 /CHANGES | |
parent | 4243a7f796a833018cf69ce25a02e18c0cf77354 (diff) |
Add CHANGES entries from 0.9.8-stable.
Diffstat (limited to 'CHANGES')
-rw-r--r-- | CHANGES | 22 |
1 files changed, 22 insertions, 0 deletions
@@ -790,6 +790,28 @@ Changes between 0.9.8k and 0.9.8l [xx XXX xxxx] + *) In dtls1_process_out_of_seq_message() the check if the current message + is already buffered was missing. For every new message was memory + allocated, allowing an attacker to perform an denial of service attack + with sending out of seq handshake messages until there is no memory + left. Additionally every future messege was buffered, even if the + sequence number made no sense and would be part of another handshake. + So only messages with sequence numbers less than 10 in advance will be + buffered. + [Robin Seggelmann, discovered by Daniel Mentz] + + *) Records are buffered if they arrive with a future epoch to be + processed after finishing the corresponding handshake. There is + currently no limitation to this buffer allowing an attacker to perform + a DOS attack with sending records with future epochs until there is no + memory left. This patch adds the pqueue_size() function to detemine + the size of a buffer and limits the record buffer to 100 entries. + [Robin Seggelmann, discovered by Daniel Mentz] + + *) Keep a copy of frag->msg_header.frag_len so it can be used after the + parent structure is freed. + [Daniel Mentz] + *) Handle non-blocking I/O properly in SSL_shutdown() call. [Darryl Miles <darryl-mailinglists@netbauds.net>] |