Only call ssl3_init_finished_mac once for DTLS

[openssl.git] / ssl / s3_cbc.c

diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index 887f43e9537e0286f3b17ed4765bbc9b19929dca..2fb71f277e9cfae99217ac4769c4e50fe37b1ebe 100644 (file)
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -149,7 +149,7 @@ int tls1_cbc_remove_padding(const SSL *s,
      */
     if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
         /* First packet is even in size, so check */
-        if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
+        if ((CRYPTO_memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
             !(padding_length & 1)) {
             s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
         }
@@ -639,12 +639,22 @@ void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
 
     if (k > 0) {
         if (is_sslv3) {
+            unsigned overhang;
+
             /*
              * The SSLv3 header is larger than a single block. overhang is
              * the number of bytes beyond a single block that the header
-             * consumes: either 7 bytes (SHA1) or 11 bytes (MD5).
+             * consumes: either 7 bytes (SHA1) or 11 bytes (MD5). There are no
+             * ciphersuites in SSLv3 that are not SHA1 or MD5 based and
+             * therefore we can be confident that the header_length will be
+             * greater than |md_block_size|. However we add a sanity check just
+             * in case
              */
-            unsigned overhang = header_length - md_block_size;
+            if (header_length <= md_block_size) {
+                /* Should never happen */
+                return;
+            }
+            overhang = header_length - md_block_size;
             md_transform(md_state.c, header);
             memcpy(first_block, header + md_block_size, overhang);
             memcpy(first_block + overhang, data, md_block_size - overhang);
@@ -761,25 +771,25 @@ void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
     if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
         return;
     block_size = EVP_MD_CTX_block_size(mac_ctx);
-        /*-
-         * We are in FIPS mode if we get this far so we know we have only SHA*
-         * digests and TLS to deal with.
-         * Minimum digest padding length is 17 for SHA384/SHA512 and 9
-         * otherwise.
-         * Additional header is 13 bytes. To get the number of digest blocks
-         * processed round up the amount of data plus padding to the nearest
-         * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
-         * So we have:
-         * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
-         * equivalently:
-         * blocks = (payload_len + digest_pad + 12)/block_size + 1
-         * HMAC adds a constant overhead.
-         * We're ultimately only interested in differences so this becomes
-         * blocks = (payload_len + 29)/128
-         * for SHA384/SHA512 and
-         * blocks = (payload_len + 21)/64
-         * otherwise.
-         */
+    /*-
+     * We are in FIPS mode if we get this far so we know we have only SHA*
+     * digests and TLS to deal with.
+     * Minimum digest padding length is 17 for SHA384/SHA512 and 9
+     * otherwise.
+     * Additional header is 13 bytes. To get the number of digest blocks
+     * processed round up the amount of data plus padding to the nearest
+     * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
+     * So we have:
+     * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
+     * equivalently:
+     * blocks = (payload_len + digest_pad + 12)/block_size + 1
+     * HMAC adds a constant overhead.
+     * We're ultimately only interested in differences so this becomes
+     * blocks = (payload_len + 29)/128
+     * for SHA384/SHA512 and
+     * blocks = (payload_len + 21)/64
+     * otherwise.
+     */
     digest_pad = block_size == 64 ? 21 : 29;
     blocks_orig = (orig_len + digest_pad) / block_size;
     blocks_data = (data_len + digest_pad) / block_size;