Author: simon
Date: Sun Aug 23 13:58:25 2009
New Revision: 196461
URL: http://svn.freebsd.org/changeset/base/196461
Log:
Import DTLS fix from upstream OpenSSL 0.9.8 branch:
Fix memory consumption bug with "future epoch" DTLS records.
Note that this will not get FreeBSD Security Advisory as DTLS is
experimental in OpenSSL.
Security: CVE-2009-1377
Obtained from: OpenSSL CVS
http://cvs.openssl.org/chngview?cn=18187
Modified:
vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c
vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h
vendor-crypto/openssl/dist/ssl/d1_pkt.c
Modified: vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c
==============================================================================
--- vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c Sun Aug 23 12:44:15
2009 (r196460)
+++ vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c Sun Aug 23 13:58:25
2009 (r196461)
@@ -234,3 +234,17 @@ pqueue_next(pitem **item)
return ret;
}
+
+int
+pqueue_size(pqueue_s *pq)
+{
+ pitem *item = pq->items;
+ int count = 0;
+
+ while(item != NULL)
+ {
+ count++;
+ item = item->next;
+ }
+ return count;
+}
Modified: vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h
==============================================================================
--- vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h Sun Aug 23 12:44:15
2009 (r196460)
+++ vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h Sun Aug 23 13:58:25
2009 (r196461)
@@ -91,5 +91,6 @@ pitem *pqueue_iterator(pqueue pq);
pitem *pqueue_next(piterator *iter);
void pqueue_print(pqueue pq);
+int pqueue_size(pqueue pq);
#endif /* ! HEADER_PQUEUE_H */
Modified: vendor-crypto/openssl/dist/ssl/d1_pkt.c
==============================================================================
--- vendor-crypto/openssl/dist/ssl/d1_pkt.c Sun Aug 23 12:44:15 2009
(r196460)
+++ vendor-crypto/openssl/dist/ssl/d1_pkt.c Sun Aug 23 13:58:25 2009
(r196461)
@@ -167,6 +167,10 @@ dtls1_buffer_record(SSL *s, record_pqueu
DTLS1_RECORD_DATA *rdata;
pitem *item;
+ /* Limit the size of the queue to prevent DOS attacks */
+ if (pqueue_size(queue->q) >= 100)
+ return 0;
+
rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
item = pitem_new(priority, rdata);
if (rdata == NULL || item == NULL)
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
