From: David Ramos <daramos@stanford.edu>
Date: Sun, 1 Jun 2014 13:30:10 +0000 (+0100)
Subject: Allocate extra space when NETSCAPE_HANG_BUG defined.
X-Git-Tag: OpenSSL_1_0_0m~15
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=268ae494533da9f3a8ea06dd2943c2e656d48456;p=oweals%2Fopenssl.git

Allocate extra space when NETSCAPE_HANG_BUG defined.

Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
(cherry picked from commit 673c42b2380c34e7500f05e7f00c674cc677a065)
---

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index cdfe035ba9..b4ec010115 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1944,6 +1944,11 @@ int ssl3_send_certificate_request(SSL *s)
 		s->init_num=n+4;
 		s->init_off=0;
 #ifdef NETSCAPE_HANG_BUG
+		if (!BUF_MEM_grow_clean(buf, s->init_num + 4))
+			{
+			SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB);
+			goto err;
+			}
 		p=(unsigned char *)s->init_buf->data + s->init_num;
 
 		/* do the header */