1 files changed, 48 insertions, 0 deletions

diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Fix-for-CVE-2014-0195.patch b/meta/recipes-connectivity/openssl/openssl/0001-Fix-for-CVE-2014-0195.patch
new file mode 100644
index 0000000000..2fae0e88ac
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Fix-for-CVE-2014-0195.patch
@@ -0,0 +1,48 @@
+From 1632ef744872edc2aa2a53d487d3e79c965a4ad3 Mon Sep 17 00:00:00 2001
+From: "Dr. Stephen Henson" <steve@openssl.org>
+Date: Tue, 13 May 2014 18:48:31 +0100
+Subject: [PATCH] Fix for CVE-2014-0195
+
+Upstream-Status: Backport
+
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A buffer overrun attack can be triggered by sending invalid DTLS fragments
+to an OpenSSL DTLS client or server. This is potentially exploitable to
+run arbitrary code on a vulnerable client or server.
+
+Fixed by adding consistency check for DTLS fragments.
+
+Thanks to Jüri Aedla for reporting this issue.
+
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ ssl/d1_both.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
+index 1bb2e4d..7de9ae4 100644
+--- a/ssl/d1_both.c
++++ b/ssl/d1_both.c
+@@ -627,7 +627,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+                frag->msg_header.frag_off = 0;
+                }
+        else
++               {
+                frag = (hm_fragment*) item->data;
++               if (frag->msg_header.msg_len != msg_hdr->msg_len)
++                       {
++                       item = NULL;
++                       frag = NULL;
++                       goto err;
++                       }
++               }
++
+ 
+        /* If message is already reassembled, this must be a
+         * retransmit and can be dropped.
+-- 
+1.7.10.4
+