diff options
| author | Mark J. Cox <mark@openssl.org> | 2008-05-28 07:29:27 +0000 |
|---|---|---|
| committer | Mark J. Cox <mark@openssl.org> | 2008-05-28 07:29:27 +0000 |
| commit | 2c0fa03dc62f052cc64bbed435e974c952ab6363 (patch) | |
| tree | 01cc32b5a70c7ba5f51d8098ce2e4a4a8d1880ac /ssl/s3_clnt.c | |
| parent | d3b3a6d389c9824c80e503229ff2a6109031736f (diff) | |
Fix flaw if 'Server Key exchange message' is omitted from a TLS
handshake which could lead to a cilent crash as found using the
Codenomicon TLS test suite (CVE-2008-1672)
Reviewed by: openssl-security@openssl.org
Obtained from: mark@awe.com
Diffstat (limited to 'ssl/s3_clnt.c')
| -rw-r--r-- | ssl/s3_clnt.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 648488b063..f6864cdc50 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -2061,6 +2061,13 @@ int ssl3_send_client_key_exchange(SSL *s) { DH *dh_srvr,*dh_clnt; + if (s->session->sess_cert == NULL) + { + ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); + SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); + goto err; + } + if (s->session->sess_cert->peer_dh_tmp != NULL) dh_srvr=s->session->sess_cert->peer_dh_tmp; else |