2 files changed, 6 insertions, 4 deletions

diff --git a/src/lib/libssl/src/ssl/t1_lib.c b/src/lib/libssl/src/ssl/t1_lib.c
index 3412e70d30..5a6c0ddba0 100644
--- a/src/lib/libssl/src/ssl/t1_lib.c
+++ b/src/lib/libssl/src/ssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.69 2014/12/06 13:21:14 jsing Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.70 2014/12/06 13:28:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1370,7 +1370,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                         ellipticcurvelist_length += (*(sdata++));
 
                         if (ellipticcurvelist_length != size - 2 ||
-                            ellipticcurvelist_length < 1) {
+                            ellipticcurvelist_length < 1 ||
+                            ellipticcurvelist_length % 2 != 0) {
                                 *al = TLS1_AD_DECODE_ERROR;
                                 return 0;
                         }
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 3412e70d30..5a6c0ddba0 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.69 2014/12/06 13:21:14 jsing Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.70 2014/12/06 13:28:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1370,7 +1370,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                         ellipticcurvelist_length += (*(sdata++));
 
                         if (ellipticcurvelist_length != size - 2 ||
-                            ellipticcurvelist_length < 1) {
+                            ellipticcurvelist_length < 1 ||
+                            ellipticcurvelist_length % 2 != 0) {
                                 *al = TLS1_AD_DECODE_ERROR;
                                 return 0;
                         }