CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/16 11:23:53
Modified files:
lib/libssl : d1_both.c
Log message:
Correct botched size check in dtls1_preprocess_fragment().
Check message length against max, rather than fragment offset and length.
Due to a various questionable code, this allows for a crafted messsage
to be sent that results in a 21MB allocation, which then promptly results
in an error. Providing that the SSL context is cleared or freed, the
allocation then freed, meaning that this has minimal impact. A similar
fix was landed in OpenSSL in 48c054fec35, although this checks against
dtls1_max_handshake_message_len() rather than max.
Thanks to Abdullah Al Ishtiaq for flagging this.
ok kenjiro@ tb@
