Attachment 901374 Details for Bug 1103593 – Upstream patch

[patch] Upstream patch

openssl-CVE-2014-0221.patch (text/plain), 1.04 KB, created by Huzaifa S. Sidhpurwala on 2014-06-02 08:30:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Huzaifa S. Sidhpurwala

Created: 2014-06-02 08:30:49 UTC

Size: 1.04 KB

patch

obsolete

>commit d30e582446b027868cdabd0994681643682045a4
>Author: Dr. Stephen Henson <steve@openssl.org>
>Date:   Fri May 16 13:00:45 2014 +0100
>
>    Fix CVE-2014-0221
>    
>    Unnecessary recursion when receiving a DTLS hello request can be used to
>    crash a DTLS client. Fixed by handling DTLS hello request without recursion.
>    
>    Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
>
>diff --git a/ssl/d1_both.c b/ssl/d1_both.c
>index 07f67f8..4c2fd03 100644
>--- a/ssl/d1_both.c
>+++ b/ssl/d1_both.c
>@@ -793,6 +793,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
> 	int i,al;
> 	struct hm_header_st msg_hdr;
> 
>+	redo:
> 	/* see if we have the required fragment already */
> 	if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
> 		{
>@@ -851,8 +852,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
> 					s->msg_callback_arg);
> 			
> 			s->init_num = 0;
>-			return dtls1_get_message_fragment(s, st1, stn,
>-				max, ok);
>+			goto redo;
> 			}
> 		else /* Incorrectly formated Hello request */
> 			{
>

Actions: View | Diff

Attachments on bug 1103593: 901374