From: Dr. Stephen Henson <steve@openssl.org>
Date: Sat, 16 May 2009 16:23:14 +0000 (+0000)
Subject: Fix from 1.0.0-stable.
X-Git-Tag: OpenSSL-fips-2_0-rc1~1660
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=481547f0feff816dfee963b518761a9d66d84ea9;hp=8d932f6fd7df8a622f3cb998dab1529247158706

Fix from 1.0.0-stable.
---

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 928a005e53..ebc03482f0 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -562,7 +562,16 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
 	if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
 		goto err;
 
-	if (msg_hdr->seq <= s->d1->handshake_read_seq)
+	/* Try to find item in queue, to prevent duplicate entries */
+	memset(seq64be,0,sizeof(seq64be));
+	seq64be[6] = (unsigned char) (msg_hdr->seq>>8);
+	seq64be[7] = (unsigned char) msg_hdr->seq;
+	item = pqueue_find(s->d1->buffered_messages, seq64be);
+	
+	/* Discard the message if sequence number was already there, is
+	 * too far in the future or the fragment is already in the queue */
+	if (msg_hdr->seq <= s->d1->handshake_read_seq ||
+		msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
 		{
 		unsigned char devnull [256];