diff options
| author | Adam Langley <agl@chromium.org> | 2014-06-20 23:00:00 +0400 |
|---|---|---|
| committer | Adam Langley <agl@chromium.org> | 2014-06-21 00:17:41 +0400 |
| commit | bed2214b3ee623f0b817fddb1042f9b0d8735243 (patch) | |
| tree | 475f721c2baf9880bcf2048ba6832649a423b5a3 /ssl/d1_both.c | |
| parent | ce7f9caa98fc62afd5fc40c0f13bc51bef2e7fa1 (diff) | |
Fix for CVE-2014-0195
A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.
Fixed by adding consistency check for DTLS fragments.
Thanks to Jüri Aedla for reporting this issue.
(Imported from upstream's eb6508d50c9a314b88ac155bd378cbd79a117c92)
Diffstat (limited to 'ssl/d1_both.c')
| -rw-r--r-- | ssl/d1_both.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/ssl/d1_both.c b/ssl/d1_both.c index 597d49bd..85ea1305 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -635,7 +635,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok) frag->msg_header.frag_off = 0; } else + { frag = (hm_fragment*) item->data; + if (frag->msg_header.msg_len != msg_hdr->msg_len) + { + item = NULL; + frag = NULL; + goto err; + } + } + /* If message is already reassembled, this must be a * retransmit and can be dropped. |