kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Additional CVE-2014-0224 protection.

Browse Source 
Return a fatal error if an attempt is made to use a zero length
master secret.

(Imported from upstream's 9d2c9dd1e1a452939a733b638d180bb308ce72a9)
This commit is contained in:
Adam Langley 2014-06-20 12:00:00 -07:00
parent 895780572b
commit ec48ffc1fe
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ssl/s3_pkt.c
View File

@ -1458,7 +1458,7 @@ int ssl3_do_change_cipher_spec(SSL *s)
if (s->s3->tmp.key_block == NULL)
{
if (s->session == NULL)
if (s->session == NULL || s->session->master_key_length == 0)
{
/* might happen if dtls1_read_bytes() calls this */
OPENSSL_PUT_ERROR(SSL, ssl3_do_change_cipher_spec, SSL_R_CCS_RECEIVED_EARLY);