From 895780572b7895784ed7088248ecb2ed5dd0c97a Mon Sep 17 00:00:00 2001 From: Adam Langley Date: Fri, 20 Jun 2014 12:00:00 -0700 Subject: [PATCH] Fix CVE-2014-0221 Unnecessary recursion when receiving a DTLS hello request can be used to crash a DTLS client. Fixed by handling DTLS hello request without recursion. Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue. (Imported from upstream's 8942b92c7cb5fa144bd79b7607b459d0b777164c) --- ssl/d1_both.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ssl/d1_both.c b/ssl/d1_both.c index fc7fa9f1..597d49bd 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -792,6 +792,7 @@ dtls1_get_message_fragment(SSL *s, int stn, long max, int *ok) int i,al; struct hm_header_st msg_hdr; + redo: /* see if we have the required fragment already */ if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok) { @@ -850,8 +851,7 @@ dtls1_get_message_fragment(SSL *s, int stn, long max, int *ok) s->msg_callback_arg); s->init_num = 0; - return dtls1_get_message_fragment(s, stn, - max, ok); + goto redo; } else /* Incorrectly formated Hello request */ {