import openssl-0.9.8j

1 files changed, 15 insertions, 1 deletions

diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index 44c7c143fe..9476dcddf6 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -753,8 +753,15 @@ int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
                         s->rwstate=SSL_NOTHING;
                         return(s->s3->wpend_ret);
                         }
-                else if (i <= 0)
+                else if (i <= 0) {
+                        if (s->version == DTLS1_VERSION ||
+                            s->version == DTLS1_BAD_VER) {
+                                /* For DTLS, just drop it. That's kind of the whole
+                                   point in using a datagram service */
+                                s->s3->wbuf.left = 0;
+                        }
                         return(i);
+                }
                 s->s3->wbuf.offset+=i;
                 s->s3->wbuf.left-=i;
                 }
@@ -1225,6 +1232,13 @@ int ssl3_do_change_cipher_spec(SSL *s)
 
         if (s->s3->tmp.key_block == NULL)
                 {
+                if (s->session == NULL) 
+                        {
+                        /* might happen if dtls1_read_bytes() calls this */
+                        SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC,SSL_R_CCS_RECEIVED_EARLY);
+                        return (0);
+                        }
+
                 s->session->cipher=s->s3->tmp.new_cipher;
                 if (!s->method->ssl3_enc->setup_key_block(s)) return(0);
                 }