From: Dr. Stephen Henson Date: Sat, 3 Jan 2015 00:45:13 +0000 (+0000) Subject: Fix crash in dtls1_get_record whilst in the listen state where you get two X-Git-Tag: OpenSSL_1_0_0p~6 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=bf6fa208b5c081c041f267c4c0352c686fa8d8a5;p=oweals%2Fopenssl.git Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. CVE-2014-3571 Reviewed-by: Matt Caswell --- diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index 8004528275..3ed2e9584d 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -634,8 +634,6 @@ again: /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */ i=rr->length; n=ssl3_read_n(s,i,i,1); - if (n <= 0) return(n); /* error or non-blocking io */ - /* this packet contained a partial record, dump it */ if ( n != i) { diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index 92a65c38bf..000f326e3c 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -182,6 +182,8 @@ int ssl3_read_n(SSL *s, int n, int max, int extend) * at once (as long as it fits into the buffer). */ if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER) { + if (left == 0 && extend) + return 0; if (left > 0 && n > left) n = left; }