From a86714041d8a5868c629e9027e28c6d1dacde5f9 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 18 Jan 2024 12:07:27 +0000 Subject: When selecting a method ensure we use the correct client/server version Using the client one when the server once should be used could cause a later call to SSL_set_accept_state() to unexpectedly fail. Reviewed-by: Hugo Landau Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23256) --- ssl/statem/statem_lib.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'ssl/statem/statem_lib.c') diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c index b16864606b..7ef74b1f69 100644 --- a/ssl/statem/statem_lib.c +++ b/ssl/statem/statem_lib.c @@ -1977,14 +1977,17 @@ int ssl_version_supported(const SSL_CONNECTION *s, int version, for (vent = table; vent->version != 0 && ssl_version_cmp(s, version, vent->version) <= 0; ++vent) { - if (vent->cmeth != NULL + const SSL_METHOD *(*thismeth)(void) = s->server ? vent->smeth + : vent->cmeth; + + if (thismeth != NULL && ssl_version_cmp(s, version, vent->version) == 0 - && ssl_method_error(s, vent->cmeth()) == 0 + && ssl_method_error(s, thismeth()) == 0 && (!s->server || version != TLS1_3_VERSION || is_tls13_capable(s))) { if (meth != NULL) - *meth = vent->cmeth(); + *meth = thismeth(); return 1; } } -- cgit v1.2.3