1 files changed, 35 insertions, 0 deletions

diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Fix-CVE-2014-3470.patch b/meta/recipes-connectivity/openssl/openssl/0001-Fix-CVE-2014-3470.patch
new file mode 100644
index 0000000000..7764658292
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Fix-CVE-2014-3470.patch
@@ -0,0 +1,35 @@
+From 8011cd56e39a433b1837465259a9bd24a38727fb Mon Sep 17 00:00:00 2001
+From: "Dr. Stephen Henson" <steve@openssl.org>
+Date: Thu, 29 May 2014 15:00:05 +0100
+Subject: [PATCH] Fix CVE-2014-3470
+
+Upstream-Status: Backport
+
+Check session_cert is not NULL before dereferencing it.
+
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ ssl/s3_clnt.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
+index c99a4c4..0457af8 100644
+--- a/ssl/s3_clnt.c
++++ b/ssl/s3_clnt.c
+@@ -2512,6 +2512,13 @@ int ssl3_send_client_key_exchange(SSL *s)
+                        int ecdh_clnt_cert = 0;
+                        int field_size = 0;
+ 
++                       if (s->session->sess_cert == NULL) 
++                               {
++                               ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
++                               SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
++                               goto err;
++                               }
++
+                        /* Did we send out the client's
+                         * ECDH share for use in premaster
+                         * computation as part of client certificate?
+-- 
+1.7.10.4
+