|
 |
1b2890 |
From 86788e1ee6908a5b3a4c95fa80caa4b724a8a434 Mon Sep 17 00:00:00 2001
|
|
|
1b2890 |
From: Gabor Tyukasz <Gabor.Tyukasz@logmein.com>
|
|
|
1b2890 |
Date: Wed, 23 Jul 2014 23:42:06 +0200
|
|
|
1b2890 |
Subject: [PATCH] Fix race condition in ssl_parse_serverhello_tlsext
|
|
|
1b2890 |
|
|
|
1b2890 |
CVE-2014-3509
|
|
|
1b2890 |
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
|
1b2890 |
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
|
|
|
1b2890 |
---
|
|
|
1b2890 |
ssl/t1_lib.c | 17 ++++++++++-------
|
|
|
1b2890 |
1 file changed, 10 insertions(+), 7 deletions(-)
|
|
|
1b2890 |
|
|
|
1b2890 |
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
|
|
|
1b2890 |
index 8167a51..022a4fb 100644
|
|
|
1b2890 |
--- a/ssl/t1_lib.c
|
|
|
1b2890 |
+++ b/ssl/t1_lib.c
|
|
|
1b2890 |
@@ -1555,15 +1555,18 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
|
|
|
1b2890 |
*al = TLS1_AD_DECODE_ERROR;
|
|
|
1b2890 |
return 0;
|
|
|
1b2890 |
}
|
|
|
1b2890 |
- s->session->tlsext_ecpointformatlist_length = 0;
|
|
|
1b2890 |
- if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
|
|
|
1b2890 |
- if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
|
|
|
1b2890 |
+ if (!s->hit)
|
|
|
1b2890 |
{
|
|
|
1b2890 |
- *al = TLS1_AD_INTERNAL_ERROR;
|
|
|
1b2890 |
- return 0;
|
|
|
1b2890 |
+ s->session->tlsext_ecpointformatlist_length = 0;
|
|
|
1b2890 |
+ if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
|
|
|
1b2890 |
+ if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
|
|
|
1b2890 |
+ {
|
|
|
1b2890 |
+ *al = TLS1_AD_INTERNAL_ERROR;
|
|
|
1b2890 |
+ return 0;
|
|
|
1b2890 |
+ }
|
|
|
1b2890 |
+ s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
|
|
|
1b2890 |
+ memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
|
|
|
1b2890 |
}
|
|
|
1b2890 |
- s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
|
|
|
1b2890 |
- memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
|
|
|
1b2890 |
#if 0
|
|
|
1b2890 |
fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
|
|
|
1b2890 |
sdata = s->session->tlsext_ecpointformatlist;
|
|
|
1b2890 |
--
|
|
|
1b2890 |
1.8.3.1
|
|
|
1b2890 |
|