From: Dr. Stephen Henson <steve@openssl.org>
Date: Tue, 13 May 2014 17:48:31 +0000 (+0100)
Subject: Fix for CVE-2014-0195
X-Git-Tag: master-post-reformat~734
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=410e444b71bca5af929fe82162cbe37e31c82083;p=oweals%2Fopenssl.git

Fix for CVE-2014-0195

A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Fixed by adding consistency check for DTLS fragments.

Thanks to Jüri Aedla for reporting this issue.
(cherry picked from commit 1632ef744872edc2aa2a53d487d3e79c965a4ad3)
---

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 820c8f08fa..228af21462 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -632,7 +632,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
 		frag->msg_header.frag_off = 0;
 		}
 	else
+		{
 		frag = (hm_fragment*) item->data;
+		if (frag->msg_header.msg_len != msg_hdr->msg_len)
+			{
+			item = NULL;
+			frag = NULL;
+			goto err;
+			}
+		}
+
 
 	/* If message is already reassembled, this must be a
 	 * retransmit and can be dropped.