1 files changed, 18 insertions, 35 deletions

diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 6dbc3c1f7d..c91f0018e4 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -597,10 +597,8 @@ void SSL_free(SSL *s)
                 OPENSSL_free(s->next_proto_negotiated);
 #endif
 
-#ifndef OPENSSL_NO_SRTP
         if (s->srtp_profiles)
             sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
-#endif
 
         OPENSSL_free(s);
         }
@@ -1338,36 +1336,33 @@ int SSL_set_cipher_list(SSL *s,const char *str)
 /* works well for SSLv2, not so good for SSLv3 */
 char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
         {
-        char *p;
+        char *end;
         STACK_OF(SSL_CIPHER) *sk;
         SSL_CIPHER *c;
+        size_t curlen = 0;
         int i;
 
         if ((s->session == NULL) || (s->session->ciphers == NULL) ||
                 (len < 2))
                 return(NULL);
 
-        p=buf;
         sk=s->session->ciphers;
+        buf[0] = '\0';
         for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
                 {
-                int n;
-
                 c=sk_SSL_CIPHER_value(sk,i);
-                n=strlen(c->name);
-                if (n+1 > len)
+                end = buf + curlen;
+                if (strlcat(buf, c->name, len) >= len ||
+                    (curlen = strlcat(buf, ":", len)) >= len)
                         {
-                        if (p != buf)
-                                --p;
-                        *p='\0';
-                        return buf;
+                        /* remove truncated cipher from list */
+                        *end = '\0';
+                        break;
                         }
-                strcpy(p,c->name);
-                p+=n;
-                *(p++)=':';
-                len-=n+1;
                 }
-        p[-1]='\0';
+        /* remove trailing colon */
+        if ((end = strrchr(buf, ':')) != NULL)
+                *end = '\0';
         return(buf);
         }
 
@@ -1797,9 +1792,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
 
         ret->extra_certs=NULL;
-        /* No compression for DTLS */
-        if (meth->version != DTLS1_VERSION)
-                ret->comp_methods=SSL_COMP_get_compression_methods();
+        ret->comp_methods=SSL_COMP_get_compression_methods();
 
         ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
 
@@ -1956,10 +1949,8 @@ void SSL_CTX_free(SSL_CTX *a)
         a->comp_methods = NULL;
 #endif
 
-#ifndef OPENSSL_NO_SRTP
         if (a->srtp_profiles)
                 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
-#endif
 
 #ifndef OPENSSL_NO_PSK
         if (a->psk_identity_hint)
@@ -2293,7 +2284,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
 #endif
 
 /* THIS NEEDS CLEANING UP */
-CERT_PKEY *ssl_get_server_send_pkey(const SSL *s)
+X509 *ssl_get_server_send_cert(SSL *s)
         {
         unsigned long alg_k,alg_a;
         CERT *c;
@@ -2348,20 +2339,12 @@ CERT_PKEY *ssl_get_server_send_pkey(const SSL *s)
                 i=SSL_PKEY_GOST01;
         else /* if (alg_a & SSL_aNULL) */
                 {
-                SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY,ERR_R_INTERNAL_ERROR);
+                SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,ERR_R_INTERNAL_ERROR);
                 return(NULL);
                 }
+        if (c->pkeys[i].x509 == NULL) return(NULL);
 
-        return c->pkeys + i;
-        }
-
-X509 *ssl_get_server_send_cert(const SSL *s)
-        {
-        CERT_PKEY *cpk;
-        cpk = ssl_get_server_send_pkey(s);
-        if (!cpk)
-                return NULL;
-        return cpk->x509;
+        return(c->pkeys[i].x509);
         }
 
 EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher, const EVP_MD **pmd)
@@ -2622,7 +2605,7 @@ const char *SSL_get_version(const SSL *s)
                 return("TLSv1.2");
         else if (s->version == TLS1_1_VERSION)
                 return("TLSv1.1");
-        else if (s->version == TLS1_VERSION)
+        if (s->version == TLS1_VERSION)
                 return("TLSv1");
         else if (s->version == SSL3_VERSION)
                 return("SSLv3");