diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2010-03-24 13:16:42 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2010-03-24 13:16:42 +0000 |
| commit | 354f92d66ad9b0aa83bb0eb6e6faf6c9bbab13d0 (patch) | |
| tree | db110b03b021a0646be5410817c6bc4c6f6018eb /ssl | |
| parent | c3484e0268cfa7b7c6db81e01fc0f837bf375e52 (diff) | |
Submitted by: Bodo Moeller and Adam Langley (Google).
Fix for "Record of death" vulnerability CVE-2010-0740.
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/s3_pkt.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index a2ba5748d5..5e3583c04d 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -291,9 +291,9 @@ again: if (version != s->version) { SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER); - /* Send back error using their - * version number :-) */ - s->version=version; + if ((s->version & 0xFF00) == (version & 0xFF00)) + /* Send back error using their minor version number :-) */ + s->version = (unsigned short)version; al=SSL_AD_PROTOCOL_VERSION; goto f_err; } |