Avoid a NULL pointer dereference that can be triggered by

SSL3_RT_HANDSHAKE replays.

Reported by Markus Stenberg <markus.stenberg at iki.fi> - thanks!

ok deraadt@

2 files changed, 4 insertions, 4 deletions

diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 6f3ee26217..7aa5aac752 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_pkt.c,v 1.35 2014/10/18 16:13:16 jsing Exp $ */
+/* $OpenBSD: d1_pkt.c,v 1.36 2014/10/22 15:29:31 jsing Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -586,7 +586,7 @@ again:
                  * would be dropped unnecessarily.
                  */
                 if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&
-                    *p == SSL3_MT_CLIENT_HELLO) &&
+                    p != NULL && *p == SSL3_MT_CLIENT_HELLO) &&
                     !dtls1_record_replay_check(s, bitmap)) {
                         rr->length = 0;
                         s->packet_length=0; /* dump this record */
diff --git a/src/lib/libssl/src/ssl/d1_pkt.c b/src/lib/libssl/src/ssl/d1_pkt.c
index 6f3ee26217..7aa5aac752 100644
--- a/src/lib/libssl/src/ssl/d1_pkt.c
+++ b/src/lib/libssl/src/ssl/d1_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_pkt.c,v 1.35 2014/10/18 16:13:16 jsing Exp $ */
+/* $OpenBSD: d1_pkt.c,v 1.36 2014/10/22 15:29:31 jsing Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -586,7 +586,7 @@ again:
                  * would be dropped unnecessarily.
                  */
                 if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&
-                    *p == SSL3_MT_CLIENT_HELLO) &&
+                    p != NULL && *p == SSL3_MT_CLIENT_HELLO) &&
                     !dtls1_record_replay_check(s, bitmap)) {
                         rr->length = 0;
                         s->packet_length=0; /* dump this record */