Hello,
I have traced again and found out that
c_zlib.c::zlib_compress_block()
is responsible that wrec->length is sometimes
44 (korrect value) and sometimes 45 (troublesome value)
I'm using zlib 1.2.3 !!!
for length 45 I'm getting the trouble
with the SSP_OP_TLS_BLOCK_PADDING_BUG
handling.
Korrekt handling
requestor side: length is 44; augmented to 48; ->data[47] = 3
provider side: length is 48; decremented with 3+1 => 44
Wrong handling
requestor side: length is 45; augmented to 48; ->data[47] = 2
provider side: length is 48; decremented with
(2+1-1/* PADDING_BUG && '\0...' FLAGS..PADDING_BUG */)
=> 46 !!!
I hope this helps - to find out whats going wrong.
Christiane Kämpfe mailto:[EMAIL PROTECTED]
EP SW SM 4 Telephone: +49 (0) 89 636 49941
Fujitsu Siemens Computers GmbH
Otto Hahn Ring 6
D-81739 München
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List openssl-dev@openssl.org
Automated List Manager [EMAIL PROTECTED]
