You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
34 lines
1.0 KiB
34 lines
1.0 KiB
commit d30e582446b027868cdabd0994681643682045a4 |
|
Author: Dr. Stephen Henson <steve@openssl.org> |
|
Date: Fri May 16 13:00:45 2014 +0100 |
|
|
|
Fix CVE-2014-0221 |
|
|
|
Unnecessary recursion when receiving a DTLS hello request can be used to |
|
crash a DTLS client. Fixed by handling DTLS hello request without recursion. |
|
|
|
Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue. |
|
|
|
diff --git a/ssl/d1_both.c b/ssl/d1_both.c |
|
index 07f67f8..4c2fd03 100644 |
|
--- a/ssl/d1_both.c |
|
+++ b/ssl/d1_both.c |
|
@@ -793,6 +793,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok) |
|
int i,al; |
|
struct hm_header_st msg_hdr; |
|
|
|
+ redo: |
|
/* see if we have the required fragment already */ |
|
if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok) |
|
{ |
|
@@ -851,8 +852,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok) |
|
s->msg_callback_arg); |
|
|
|
s->init_num = 0; |
|
- return dtls1_get_message_fragment(s, st1, stn, |
|
- max, ok); |
|
+ goto redo; |
|
} |
|
else /* Incorrectly formated Hello request */ |
|
{ |
|
|
|
|