From: Erik Auerswald <auerswal@unix-ag.uni-kl.de>
Date: Wed, 27 Aug 2014 02:50:34 +0000 (-0400)
Subject: RT3301: Discard too-long heartbeat requests
X-Git-Tag: master-post-reformat~399
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=af4c6e348e4bad6303e7d214cdcf2536487aabe4

RT3301: Discard too-long heartbeat requests

Reviewed-by: Tim Hudson <tjh@openssl.org>
---

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 33d0ae3ce4..f2ff943001 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -1363,6 +1363,9 @@ dtls1_process_heartbeat(SSL *s)
 	/* Read type and payload length first */
 	if (1 + 2 + 16 > s->s3->rrec.length)
 		return 0; /* silently discard */
+	if (s->s3->rrec.length > SSL3_RT_MAX_PLAIN_LENGTH)
+		return 0; /* silently discard per RFC 6520 sec. 4 */
+
 	hbtype = *p++;
 	n2s(p, payload);
 	if (1 + 2 + payload + 16 > s->s3->rrec.length)