diff options
| -rw-r--r-- | ssl/d1_both.c | 9 | ||||
| -rw-r--r-- | ssl/s3_clnt.c | 7 |
2 files changed, 16 insertions, 0 deletions
diff --git a/ssl/d1_both.c b/ssl/d1_both.c index de8bab8..b4d52d7 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -620,7 +620,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok) frag->msg_header.frag_off = 0; } else + { frag = (hm_fragment*) item->data; + if (frag->msg_header.msg_len != msg_hdr->msg_len) + { + item = NULL; + frag = NULL; + goto err; + } + } + /* If message is already reassembled, this must be a * retransmit and can be dropped. diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index edfcf58..9eabfd8 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -2591,6 +2591,13 @@ int ssl3_send_client_key_exchange(SSL *s) int ecdh_clnt_cert = 0; int field_size = 0; + if (s->session->sess_cert == NULL) + { + ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); + SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); + goto err; + } + /* Did we send out the client's * ECDH share for use in premaster * computation as part of client certificate? |