Fix from 1.0.0-stable branch.

diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
index 3f568da142dbf8590ed98a99ee2f558d82e0dda7..80d31b199de984076985e072072594780a5031c2 100644 (file)
--- a/crypto/bio/bss_dgram.c
+++ b/crypto/bio/bss_dgram.c
@@ -289,9 +289,6 @@ static int dgram_read(BIO *b, char *out, int outl)
                                BIO_set_retry_read(b);
                                data->_errno = get_last_socket_error();
                                }
-#if 0
-                       memset(&(data->hstimeout), 0, sizeof(struct timeval));
-#endif
                        }
                }
        return(ret);

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 5727c73776be506377ef2b9ec39c63091caaf22b..63d00062f2aaba8ece742b01646a2ceff298cc00 100644 (file)
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -561,7 +561,16 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
        if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
                goto err;
 
-       if (msg_hdr->seq <= s->d1->handshake_read_seq)
+       /* Try to find item in queue, to prevent duplicate entries */
+       memset(seq64be,0,sizeof(seq64be));
+       seq64be[6] = (unsigned char) (msg_hdr->seq>>8);
+       seq64be[7] = (unsigned char) msg_hdr->seq;
+       item = pqueue_find(s->d1->buffered_messages, seq64be);
+       
+       /* Discard the message if sequence number was already there, is
+        * too far in the future or the fragment is already in the queue */
+       if (msg_hdr->seq <= s->d1->handshake_read_seq ||
+               msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
                {
                unsigned char devnull [256];