1 files changed, 9 insertions, 5 deletions

diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index bfd4731365..a649dafba9 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -2441,16 +2441,20 @@ tls1_process_heartbeat(SSL *s)
         unsigned int payload;
         unsigned int padding = 16; /* Use minimum padding */
 
-        /* Read type and payload length first */
-        hbtype = *p++;
-        n2s(p, payload);
-        pl = p;
-
         if (s->msg_callback)
                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
                         &s->s3->rrec.data[0], s->s3->rrec.length,
                         s, s->msg_callback_arg);
 
+        /* Read type and payload length first */
+        if (1 + 2 + 16 > s->s3->rrec.length)
+                return 0; /* silently discard */
+        hbtype = *p++;
+        n2s(p, payload);
+        if (1 + 2 + payload + 16 > s->s3->rrec.length)
+                return 0; /* silently discard per RFC 6520 sec. 4 */
+        pl = p;
+
         if (hbtype == TLS1_HB_REQUEST)
                 {
                 unsigned char *buffer, *bp;