diff options
| author | Matt Caswell <matt@openssl.org> | 2015-05-29 17:05:01 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2015-06-01 00:30:15 +0100 |
| commit | 8c2b1d872b25f3ec78e04f5cd2de8f21e853c4a6 (patch) | |
| tree | 4bd942501fb3505c8145977cfe7b343b0ebfe1e4 /ssl | |
| parent | 1c8a527cff6cd4e07935e5a86335963e93adf75a (diff) | |
Check the message type requested is the type received in DTLS
dtls1_get_message has an |mt| variable which is the type of the message that
is being requested. If it is negative then any message type is allowed.
However the value of |mt| is not checked in one of the main code paths, so a
peer can send a message of a completely different type and it will be
processed as if it was the message type that we were expecting. This has
very little practical consequences because the current behaviour will still
fail when the format of the message isn't as expected.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/d1_both.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/ssl/d1_both.c b/ssl/d1_both.c index bcdba74819..569b561e85 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -478,6 +478,12 @@ long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok) return i; } + if (mt >= 0 && s->s3->tmp.message_type != mt) { + al = SSL_AD_UNEXPECTED_MESSAGE; + SSLerr(SSL_F_DTLS1_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE); + goto f_err; + } + p = (unsigned char *)s->init_buf->data; msg_len = msg_hdr->msg_len; |