diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2015-01-03 03:45:13 +0300 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2015-01-08 14:18:16 +0300 |
| commit | feba02f3919495e1b960c33ba849e10e77d0785d (patch) | |
| tree | a5b21b7ca3be296260a23ed17ce8388c59dd321e /ssl/s3_pkt.c | |
| parent | 4a4d4158572fd8b3dc641851b8378e791df7972d (diff) | |
Fix crash in dtls1_get_record whilst in the listen state where you get two
separate reads performed - one for the header and one for the body of the
handshake record.
CVE-2014-3571
Reviewed-by: Matt Caswell <matt@openssl.org>
Diffstat (limited to 'ssl/s3_pkt.c')
| -rw-r--r-- | ssl/s3_pkt.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index 2de10d644e..3d8f821f92 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -197,6 +197,8 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) * at once (as long as it fits into the buffer). */ if (SSL_IS_DTLS(s)) { + if (left == 0 && extend) + return 0; if (left > 0 && n > left) n = left; } |