diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2015-01-03 00:45:13 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2015-01-08 11:28:17 +0000 |
commit | 46bf0ba87665c5aa215673d87e9ee7dd4ce28359 (patch) | |
tree | 8532ce162a11814922721c9c8e07c8e2e3b43c58 /ssl/s3_pkt.c | |
parent | 4b4c0a19211bf73d81de52de697a1a9dc60aed82 (diff) |
Fix crash in dtls1_get_record whilst in the listen state where you get two
separate reads performed - one for the header and one for the body of the
handshake record.
CVE-2014-3571
Reviewed-by: Matt Caswell <matt@openssl.org>
Conflicts:
ssl/s3_pkt.c
Diffstat (limited to 'ssl/s3_pkt.c')
-rw-r--r-- | ssl/s3_pkt.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index a3b45fba9d..1adc301911 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -147,6 +147,8 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) * at once (as long as it fits into the buffer). */ if (SSL_version(s) == DTLS1_VERSION) { + if (s->s3->rbuf.left == 0 && extend) + return 0; if ( s->s3->rbuf.left > 0 && n > s->s3->rbuf.left) n = s->s3->rbuf.left; } |