From: Dr. Stephen Henson <steve@openssl.org>
Date: Fri, 16 May 2014 12:00:45 +0000 (+0100)
Subject: Fix CVE-2014-0221
X-Git-Tag: OpenSSL_1_0_1h~3
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=d3152655d5319ce883c8e3ac4b99f8de4c59d846;p=oweals%2Fopenssl.git

Fix CVE-2014-0221

Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without recursion.

Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
---

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 7de9ae4b5f..04aa23107e 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -793,6 +793,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
 	int i,al;
 	struct hm_header_st msg_hdr;
 
+	redo:
 	/* see if we have the required fragment already */
 	if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
 		{
@@ -851,8 +852,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
 					s->msg_callback_arg);
 			
 			s->init_num = 0;
-			return dtls1_get_message_fragment(s, st1, stn,
-				max, ok);
+			goto redo;
 			}
 		else /* Incorrectly formated Hello request */
 			{