|
@@ -0,0 +1,38 @@
|
|
|
+commit d30e582446b027868cdabd0994681643682045a4
|
|
|
+Author: Dr. Stephen Henson <steve@openssl.org>
|
|
|
+Date: Fri May 16 13:00:45 2014 +0100
|
|
|
+
|
|
|
+ Fix CVE-2014-0221
|
|
|
+
|
|
|
+ Unnecessary recursion when receiving a DTLS hello request can be used to
|
|
|
+ crash a DTLS client. Fixed by handling DTLS hello request without recursion.
|
|
|
+
|
|
|
+ Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
|
|
|
+
|
|
|
+Patch borrowed from Fedora
|
|
|
+Upstream-Status: Backport
|
|
|
+Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
|
|
|
+
|
|
|
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
|
|
|
+index 07f67f8..4c2fd03 100644
|
|
|
+--- a/ssl/d1_both.c
|
|
|
++++ b/ssl/d1_both.c
|
|
|
+@@ -793,6 +793,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
|
|
|
+ int i,al;
|
|
|
+ struct hm_header_st msg_hdr;
|
|
|
+
|
|
|
++ redo:
|
|
|
+ /* see if we have the required fragment already */
|
|
|
+ if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
|
|
|
+ {
|
|
|
+@@ -851,8 +852,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
|
|
|
+ s->msg_callback_arg);
|
|
|
+
|
|
|
+ s->init_num = 0;
|
|
|
+- return dtls1_get_message_fragment(s, st1, stn,
|
|
|
+- max, ok);
|
|
|
++ goto redo;
|
|
|
+ }
|
|
|
+ else /* Incorrectly formated Hello request */
|
|
|
+ {
|
|
|
+
|