From: Matt Caswell <matt@openssl.org>
Date: Thu, 11 May 2017 11:45:16 +0000 (+0100)
Subject: Add some extra comments following alert changes
X-Git-Tag: OpenSSL_1_1_1-pre1~1531
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=9010b7bc6ec7ffc6713ad5710d846b197c0ca697;p=oweals%2Fopenssl.git

Add some extra comments following alert changes

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3436)
---

diff --git a/ssl/record/ssl3_record.c b/ssl/record/ssl3_record.c
index aea52fd7fa..bafc976cde 100644
--- a/ssl/record/ssl3_record.c
+++ b/ssl/record/ssl3_record.c
@@ -644,6 +644,10 @@ int ssl3_get_record(SSL *s)
                                 &thisrr->data[end], 1, s, s->msg_callback_arg);
         }
 
+        /*
+         * TLSv1.3 alert and handshake records are required to be non-zero in
+         * length.
+         */
         if (SSL_IS_TLS13(s)
                 && (thisrr->type == SSL3_RT_HANDSHAKE
                     || thisrr->type == SSL3_RT_ALERT)
diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c
index 34871114b9..d37cbc399e 100644
--- a/ssl/statem/statem_lib.c
+++ b/ssl/statem/statem_lib.c
@@ -589,6 +589,10 @@ MSG_PROCESS_RETURN tls_process_key_update(SSL *s, PACKET *pkt)
         goto err;
     }
 
+    /*
+     * There are only two defined key update types. Fail if we get a value we
+     * didn't recognise.
+     */
     if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
             && updatetype != SSL_KEY_UPDATE_REQUESTED) {
         al = SSL_AD_ILLEGAL_PARAMETER;