1 files changed, 11 insertions, 9 deletions

diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 0baa70663a..85371c87b8 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1013,9 +1013,9 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 
 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
         {
+        unsigned short length;
         unsigned short type;
         unsigned short size;
-        unsigned short len;  
         unsigned char *data = *p;
         int tlsext_servername = 0;
         int renegotiate_seen = 0;
@@ -1023,7 +1023,12 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
         if (data >= (d+n-2))
                 goto ri_check;
 
-        n2s(data,len);
+        n2s(data,length);
+        if (data+length != d+n)
+                {
+                *al = SSL_AD_DECODE_ERROR;
+                return 0;
+                }
 
         while(data <= (d+n-4))
                 {
@@ -1453,23 +1458,20 @@ int ssl_check_serverhello_tlsext(SSL *s)
         int al = SSL_AD_UNRECOGNIZED_NAME;
 
 #ifndef OPENSSL_NO_EC
-        /* If we are client and using an elliptic curve cryptography cipher suite, then server
-         * must return a an EC point formats lists containing uncompressed.
+        /* If we are client and using an elliptic curve cryptography cipher
+         * suite, then if server returns an EC point formats lists extension
+         * it must contain uncompressed.
          */
         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && 
+            (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && 
             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
                 {
                 /* we are using an ECC cipher */
                 size_t i;
                 unsigned char *list;
                 int found_uncompressed = 0;
-                if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
-                        {
-                        SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
-                        return -1;
-                        }
                 list = s->session->tlsext_ecpointformatlist;
                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
                         {