Fix Bleichenbacher PKCS #1 1.5 countermeasure.

[oweals/openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 105bcb2fca8abc8e425230d65d3c2ee37b28e14b..1fe85b6cb7560ac209381f11641bb55b9ac73ecf 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -576,13 +576,6 @@ int SSL_get_read_ahead(SSL *s)
 
 int SSL_pending(SSL *s)
        {
-       /* SSL_pending cannot work properly if read-ahead is enabled
-        * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)),
-        * and it is impossible to fix since SSL_pending cannot report
-        * errors that may be observed while scanning the new data.
-        * (Note that SSL_pending() is often used as a boolean value,
-        * so we'd better not return -1.)
-        */
        return(s->method->ssl_pending(s));
        }
 
@@ -715,7 +708,7 @@ long SSL_get_default_timeout(SSL *s)
        return(s->method->get_timeout());
        }
 
-int SSL_read(SSL *s,char *buf,int num)
+int SSL_read(SSL *s,void *buf,int num)
        {
        if (s->handshake_func == 0)
                {
@@ -731,8 +724,14 @@ int SSL_read(SSL *s,char *buf,int num)
        return(s->method->ssl_read(s,buf,num));
        }
 
-int SSL_peek(SSL *s,char *buf,int num)
+int SSL_peek(SSL *s,void *buf,int num)
        {
+       if (s->handshake_func == 0)
+               {
+               SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
+               return -1;
+               }
+
        if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
                {
                return(0);
@@ -740,7 +739,7 @@ int SSL_peek(SSL *s,char *buf,int num)
        return(s->method->ssl_peek(s,buf,num));
        }
 
-int SSL_write(SSL *s,const char *buf,int num)
+int SSL_write(SSL *s,const void *buf,int num)
        {
        if (s->handshake_func == 0)
                {
@@ -1550,8 +1549,6 @@ int SSL_get_error(SSL *s,int i)
                        reason=BIO_get_retry_reason(bio);
                        if (reason == BIO_RR_CONNECT)
                                return(SSL_ERROR_WANT_CONNECT);
-                       else if (reason == BIO_RR_ACCEPT)
-                               return(SSL_ERROR_WANT_ACCEPT);
                        else
                                return(SSL_ERROR_SYSCALL); /* unknown */
                        }
@@ -1570,8 +1567,6 @@ int SSL_get_error(SSL *s,int i)
                        reason=BIO_get_retry_reason(bio);
                        if (reason == BIO_RR_CONNECT)
                                return(SSL_ERROR_WANT_CONNECT);
-                       else if (reason == BIO_RR_ACCEPT)
-                               return(SSL_ERROR_WANT_ACCEPT);
                        else
                                return(SSL_ERROR_SYSCALL);
                        }
@@ -1690,6 +1685,10 @@ SSL *SSL_dup(SSL *s)
 
                if (s->cert != NULL)
                        {
+                       if (ret->cert != NULL)
+                               {
+                               ssl_cert_free(ret->cert);
+                               }
                        ret->cert = ssl_cert_dup(s->cert);
                        if (ret->cert == NULL)
                                goto err;