Limit the number of sequential empty records that we will process

before yielding, and fail if we exceed a maximum. loosely based
on what boring and openssl are doing
ok jsing@

1 files changed, 2 insertions, 1 deletions

diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index 05669aea8e..2122fea936 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.124 2017/01/26 00:29:04 jsing Exp $ */
+/* $OpenBSD: ssl.h,v 1.125 2017/01/26 07:20:57 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2064,6 +2064,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_WRONG_VERSION_NUMBER                       267
 #define SSL_R_X509_LIB                                   268
 #define SSL_R_X509_VERIFICATION_SETUP_PROBLEMS           269
+#define SSL_R_PEER_BEHAVING_BADLY                        666
 
 #ifdef  __cplusplus
 }