head	1.2;
access;
symbols;
locks; strict;
comment	@# @;


1.2
date	2009.05.20.19.22.47;	author dinoex;	state dead;
branches;
next	1.1;

1.1
date	2009.05.20.12.56.26;	author dinoex;	state Exp;
branches;
next	;


desc
@@


1.2
log
@- add more DTLS bugfixes
- use options framework
- new option WITH_FIPS
add fips code
- new option WITH_SCTP
add SCTP support to openssl
@
text
@Obtained-from: http://rt.openssl.org/Ticket/Attachment/22314/10203/dtls-fragment-memleak-bug.patch

--- ssl/d1_both.c	2009-05-18 09:57:08.000000000 +0200
+++ ssl/d1_both.c	2009-05-18 10:08:51.000000000 +0200
@@@@ -561,7 +561,16 @@@@
 	if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
 		goto err;
 
-	if (msg_hdr->seq <= s->d1->handshake_read_seq)
+	/* Try to find item in queue, to prevent duplicate entries */
+	pq_64bit_init(&seq64);
+	pq_64bit_assign_word(&seq64, msg_hdr->seq);
+	item = pqueue_find(s->d1->buffered_messages, seq64);
+	pq_64bit_free(&seq64);
+	
+	/* Discard the message if sequence number was already there, is
+	 * too far in the future or the fragment is already in the queue */
+	if (msg_hdr->seq <= s->d1->handshake_read_seq ||
+		msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
 		{
 		unsigned char devnull [256];
 
@


1.1
log
@- Security Fix
Security:	CVE-2009-1377
Security:	CVE-2009-1378
Security:	http://article.gmane.org/gmane.comp.security.oss.general/1769
PR:		134653
@
text
@@

