Fix CVE-2014-0221
Unnecessary recursion when receiving a DTLS hello request can be used to
crash a DTLS client. Fixed by handling DTLS hello request without
recursion.
Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
(Imported from upstream's 8942b92c7cb5fa144bd79b7607b459d0b777164c)
diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index fc7fa9f..597d49b 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -792,6 +792,7 @@
int i,al;
struct hm_header_st msg_hdr;
+ redo:
/* see if we have the required fragment already */
if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
{
@@ -850,8 +851,7 @@
s->msg_callback_arg);
s->init_num = 0;
- return dtls1_get_message_fragment(s, stn,
- max, ok);
+ goto redo;
}
else /* Incorrectly formated Hello request */
{
