From e5f706590c7b1f19ca34415593aebdb6cbef355b Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 29 May 2014 15:00:05 +0100 Subject: [PATCH] Fix CVE-2014-3470 Check session_cert is not NULL before dereferencing it. (cherry picked from commit 8011cd56e39a433b1837465259a9bd24a38727fb) --- ssl/s3_clnt.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 12fac10d08..2cba7c8441 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -2689,6 +2689,13 @@ int ssl3_send_client_key_exchange(SSL *s) int ecdh_clnt_cert = 0; int field_size = 0; + if (s->session->sess_cert == NULL) + { + ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); + SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); + goto err; + } + /* Did we send out the client's * ECDH share for use in premaster * computation as part of client certificate? -- 2.25.1