X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fd1_both.c;h=51d484d7eaad599870b9146c5e17cdd1a5053821;hp=820c8f08fa90365faf89e29964c1846ce2cbbee1;hb=0518a3e19e18cfc441cab261b28441b8c8bd77bf;hpb=b4322e1de8be66ff230e26999b766ca1a42f9476

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 820c8f08fa..51d484d7ea 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -632,7 +632,16 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
 		frag->msg_header.frag_off = 0;
 		}
 	else
+		{
 		frag = (hm_fragment*) item->data;
+		if (frag->msg_header.msg_len != msg_hdr->msg_len)
+			{
+			item = NULL;
+			frag = NULL;
+			goto err;
+			}
+		}
+
 
 	/* If message is already reassembled, this must be a
 	 * retransmit and can be dropped.
@@ -1042,6 +1051,8 @@ dtls1_buffer_message(SSL *s, int is_ccs)
 	OPENSSL_assert(s->init_off == 0);
 
 	frag = dtls1_hm_fragment_new(s->init_num, 0);
+	if (!frag)
+		return 0;
 
 	memcpy(frag->fragment, s->init_buf->data, s->init_num);