diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2014-05-16 13:00:45 +0100 |
|---|---|---|
| committer | Dan Pasanen <dan.pasanen@gmail.com> | 2014-06-05 19:10:01 -0500 |
| commit | 8653da8cff028c270f7689d149f6ef6a9956f8d5 (patch) | |
| tree | 3cda0f03f8ef0f46c516b7e4b5b1457c4d1ccc2b | |
| parent | df94c89aee62568162f2476a7d5c034253da9d0c (diff) | |
| download | replicant_openssl-8653da8cff028c270f7689d149f6ef6a9956f8d5.zip replicant_openssl-8653da8cff028c270f7689d149f6ef6a9956f8d5.tar.gz replicant_openssl-8653da8cff028c270f7689d149f6ef6a9956f8d5.tar.bz2 | |
Fix CVE-2014-0221
Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without recursion.
Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
(cherry picked from commit d3152655d5319ce883c8e3ac4b99f8de4c59d846)
Change-Id: I88ea85e2f3e166bc9eba1fef2127e1e0bb8c13c2
| -rw-r--r-- | ssl/d1_both.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ssl/d1_both.c b/ssl/d1_both.c index 436ab67..214b45b 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -777,6 +777,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok) int i,al; struct hm_header_st msg_hdr; + redo: /* see if we have the required fragment already */ if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok) { @@ -835,8 +836,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok) s->msg_callback_arg); s->init_num = 0; - return dtls1_get_message_fragment(s, st1, stn, - max, ok); + goto redo; } else /* Incorrectly formated Hello request */ { |