pull Ben Lauries blind prefix injection fix for CVE-2009-3555 from

openssl 0.9.8l; crank minor version; ok djm@ deraadt@; initially from jsg@

1 files changed, 3 insertions, 0 deletions

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 8916a0b1b3..5aa7bb21da 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -2592,6 +2592,9 @@ int ssl3_renegotiate(SSL *s)
         if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
                 return(0);
 
+        if (!(s->s3->flags & SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+                return(0);
+
         s->s3->renegotiate=1;
         return(1);
         }