Avoid a buffer overflow that can be triggered by sending specially crafted

DTLS fragments.

Fix for CVE-2014-0195, from OpenSSL.

Reported to OpenSSL by Juri Aedla.

ok deraadt@ beck@

2 files changed, 14 insertions, 2 deletions

diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index 8e2843625b..3674ed6046 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -586,8 +586,14 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
                 memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
                 frag->msg_header.frag_len = frag->msg_header.msg_len;
                 frag->msg_header.frag_off = 0;
-        } else
+        } else {
                 frag = (hm_fragment*)item->data;
+                if (frag->msg_header.msg_len != msg_hdr->msg_len) {
+                        item = NULL;
+                        frag = NULL;
+                        goto err;
+                }
+        }
 
         /* If message is already reassembled, this must be a
          * retransmit and can be dropped.
diff --git a/src/lib/libssl/src/ssl/d1_both.c b/src/lib/libssl/src/ssl/d1_both.c
index 8e2843625b..3674ed6046 100644
--- a/src/lib/libssl/src/ssl/d1_both.c
+++ b/src/lib/libssl/src/ssl/d1_both.c
@@ -586,8 +586,14 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
                 memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
                 frag->msg_header.frag_len = frag->msg_header.msg_len;
                 frag->msg_header.frag_off = 0;
-        } else
+        } else {
                 frag = (hm_fragment*)item->data;
+                if (frag->msg_header.msg_len != msg_hdr->msg_len) {
+                        item = NULL;
+                        frag = NULL;
+                        goto err;
+                }
+        }
 
         /* If message is already reassembled, this must be a
          * retransmit and can be dropped.