diff options
author | marha <marha@users.sourceforge.net> | 2014-04-14 23:45:39 +0200 |
---|---|---|
committer | marha <marha@users.sourceforge.net> | 2014-04-14 23:45:39 +0200 |
commit | 7c21629fbeb51b65fd0625bb36d888587d62fd89 (patch) | |
tree | 425433df36d64f529d2222de2d1680e0b0abca3f /openssl/ssl/d1_both.c | |
parent | 0bd141efd4832e01c8b269b8566dd5749e30ed55 (diff) | |
parent | 242d48135a12fc9167430f391ba0d27d9ad44c6b (diff) | |
download | vcxsrv-7c21629fbeb51b65fd0625bb36d888587d62fd89.tar.gz vcxsrv-7c21629fbeb51b65fd0625bb36d888587d62fd89.tar.bz2 vcxsrv-7c21629fbeb51b65fd0625bb36d888587d62fd89.zip |
Merge remote-tracking branch 'origin/released'
Conflicts:
openssl/Configure
openssl/Makefile
openssl/util/pl/VC-32.pl
Diffstat (limited to 'openssl/ssl/d1_both.c')
-rw-r--r-- | openssl/ssl/d1_both.c | 26 |
1 files changed, 18 insertions, 8 deletions
diff --git a/openssl/ssl/d1_both.c b/openssl/ssl/d1_both.c index 7a5596a6b..2e8cf681e 100644 --- a/openssl/ssl/d1_both.c +++ b/openssl/ssl/d1_both.c @@ -1459,26 +1459,36 @@ dtls1_process_heartbeat(SSL *s) unsigned int payload; unsigned int padding = 16; /* Use minimum padding */ - /* Read type and payload length first */ - hbtype = *p++; - n2s(p, payload); - pl = p; - if (s->msg_callback) s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT, &s->s3->rrec.data[0], s->s3->rrec.length, s, s->msg_callback_arg); + /* Read type and payload length first */ + if (1 + 2 + 16 > s->s3->rrec.length) + return 0; /* silently discard */ + hbtype = *p++; + n2s(p, payload); + if (1 + 2 + payload + 16 > s->s3->rrec.length) + return 0; /* silently discard per RFC 6520 sec. 4 */ + pl = p; + if (hbtype == TLS1_HB_REQUEST) { unsigned char *buffer, *bp; + unsigned int write_length = 1 /* heartbeat type */ + + 2 /* heartbeat length */ + + payload + padding; int r; + if (write_length > SSL3_RT_MAX_PLAIN_LENGTH) + return 0; + /* Allocate memory for the response, size is 1 byte * message type, plus 2 bytes payload length, plus * payload, plus padding */ - buffer = OPENSSL_malloc(1 + 2 + payload + padding); + buffer = OPENSSL_malloc(write_length); bp = buffer; /* Enter response type, length and copy payload */ @@ -1489,11 +1499,11 @@ dtls1_process_heartbeat(SSL *s) /* Random padding */ RAND_pseudo_bytes(bp, padding); - r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding); + r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, write_length); if (r >= 0 && s->msg_callback) s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT, - buffer, 3 + payload + padding, + buffer, write_length, s, s->msg_callback_arg); OPENSSL_free(buffer); |