1 files changed, 9 insertions, 11 deletions

diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 85371c87b8..0baa70663a 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1013,9 +1013,9 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 
 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
         {
-        unsigned short length;
         unsigned short type;
         unsigned short size;
+        unsigned short len;  
         unsigned char *data = *p;
         int tlsext_servername = 0;
         int renegotiate_seen = 0;
@@ -1023,12 +1023,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
         if (data >= (d+n-2))
                 goto ri_check;
 
-        n2s(data,length);
-        if (data+length != d+n)
-                {
-                *al = SSL_AD_DECODE_ERROR;
-                return 0;
-                }
+        n2s(data,len);
 
         while(data <= (d+n-4))
                 {
@@ -1458,20 +1453,23 @@ int ssl_check_serverhello_tlsext(SSL *s)
         int al = SSL_AD_UNRECOGNIZED_NAME;
 
 #ifndef OPENSSL_NO_EC
-        /* If we are client and using an elliptic curve cryptography cipher
-         * suite, then if server returns an EC point formats lists extension
-         * it must contain uncompressed.
+        /* If we are client and using an elliptic curve cryptography cipher suite, then server
+         * must return a an EC point formats lists containing uncompressed.
          */
         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && 
-            (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && 
             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
                 {
                 /* we are using an ECC cipher */
                 size_t i;
                 unsigned char *list;
                 int found_uncompressed = 0;
+                if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
+                        {
+                        SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
+                        return -1;
+                        }
                 list = s->session->tlsext_ecpointformatlist;
                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
                         {