Index: s3_pkt.c
===================================================================
RCS file: /v/openssl/cvs/openssl/ssl/s3_pkt.c,v
retrieving revision 1.74
diff -u -r1.74 s3_pkt.c
--- s3_pkt.c	20 Apr 2009 11:33:11 -0000	1.74
+++ s3_pkt.c	9 Jul 2009 18:28:07 -0000
@@ -149,6 +149,13 @@
 
 	if (!extend)
 		{
+		if (SSL_version(s) == DTLS1_VERSION ||
+		    SSL_version(s) == DTLS1_BAD_VER)
+			{
+			/* When we start reading a new packet,
+			 * drop whats left from the the last one */
+			left = 0;
+			}
 		/* start with empty packet ... */
 		if (left == 0)
 			rb->offset = align;
@@ -160,7 +167,7 @@
 			if (pkt[0] == SSL3_RT_APPLICATION_DATA
 			    && (pkt[3]<<8|pkt[4]) >= 128)
 				{
-			 	/* Note that even if packet is corrupted
+				/* Note that even if packet is corrupted
 				 * and its length field is insane, we can
 				 * only be led to wrong decision about
 				 * whether memmove will occur or not.
@@ -176,11 +183,13 @@
 		/* ... now we can act as if 'extend' was set */
 		}
 
-	/* extend reads should not span multiple packets for DTLS */
-	if ( (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
-	     &&	extend)
+	/* For DTLS/UDP reads should not span multiple packets
+	 * because the read operation returns the whole packet
+	 * at once (as long as it fits into the buffer). */
+	if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
 		{
-		if ( left > 0 && n > left)
+		if (left > 0 && n > left)
+			/* extend != 0 since left > 0 */
 			n = left;
 		}
 
@@ -207,8 +216,7 @@
 		rb->offset = len + align;
 		}
 
-	max = rb->len - rb->offset;
-	if (n > max) /* does not happen */
+	if (n > (rb->len - rb->offset)) /* does not happen */
 		{
 		SSLerr(SSL_F_SSL3_READ_N,ERR_R_INTERNAL_ERROR);
 		return -1;
@@ -244,6 +252,14 @@
 			return(i);
 			}
 		left+=i;
+		/* reads should *never* span multiple packets for DTLS because
+		 * the underlying transport protocol is message oriented as opposed
+		 * to byte oriented as in the TLS case. */
+		if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
+			{
+			if (n > left)
+				n = left; /* makes the while condition false */
+			}
 		}
 
 	/* done reading, now the book-keeping */
Index: d1_pkt.c
===================================================================
RCS file: /v/openssl/cvs/openssl/ssl/d1_pkt.c,v
retrieving revision 1.36
diff -u -r1.36 d1_pkt.c
--- d1_pkt.c	4 Jul 2009 12:04:06 -0000	1.36
+++ d1_pkt.c	9 Jul 2009 18:28:08 -0000
@@ -561,7 +561,12 @@
 		/* read timeout is handled by dtls1_read_bytes */
 		if (n <= 0) return(n); /* error or non-blocking */
 
-		OPENSSL_assert(s->packet_length == DTLS1_RT_HEADER_LENGTH);
+		/* this packet contained a partial record, dump it */
+		if (s->packet_length != DTLS1_RT_HEADER_LENGTH)
+			{
+			s->packet_length = 0;
+			goto again;
+			}
 
 		s->rstate=SSL_ST_READ_BODY;