MFC DTLS buffer overflow fix (CVE-2014-0195)

"Avoid a buffer overflow that can be triggered by sending specially crafted
DTLS fragments. Fix for CVE-2014-0195, from OpenSSL. Reported to OpenSSL
by Juri Aedla." From d1_both.c r1.19

1 files changed, 7 insertions, 1 deletions

diff --git a/src/lib/libssl/src/ssl/d1_both.c b/src/lib/libssl/src/ssl/d1_both.c
index 94ff9a2d14..5cbc0c6a44 100644
--- a/src/lib/libssl/src/ssl/d1_both.c
+++ b/src/lib/libssl/src/ssl/d1_both.c
@@ -626,8 +626,14 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
                 frag->msg_header.frag_len = frag->msg_header.msg_len;
                 frag->msg_header.frag_off = 0;
                 }
-        else
+        else {
                 frag = (hm_fragment*) item->data;
+                if (frag->msg_header.msg_len != msg_hdr->msg_len) {
+                        item = NULL;
+                        frag = NULL;
+                        goto err;
+                }
+        }
 
         /* If message is already reassembled, this must be a
          * retransmit and can be dropped.