blob: 7764658292b001e96c796b2da0932e60afe51d06 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
From 8011cd56e39a433b1837465259a9bd24a38727fb Mon Sep 17 00:00:00 2001
From: "Dr. Stephen Henson" <steve@openssl.org>
Date: Thu, 29 May 2014 15:00:05 +0100
Subject: [PATCH] Fix CVE-2014-3470
Upstream-Status: Backport
Check session_cert is not NULL before dereferencing it.
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
ssl/s3_clnt.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index c99a4c4..0457af8 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2512,6 +2512,13 @@ int ssl3_send_client_key_exchange(SSL *s)
int ecdh_clnt_cert = 0;
int field_size = 0;
+ if (s->session->sess_cert == NULL)
+ {
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
+ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
+ goto err;
+ }
+
/* Did we send out the client's
* ECDH share for use in premaster
* computation as part of client certificate?
--
1.7.10.4
|
