From: Matt Caswell <matt@openssl.org>
Date: Thu, 24 Jul 2014 22:54:28 +0000 (+0100)
Subject: Applying same fix as in dtls1_process_out_of_seq_message. A truncated DTLS fragment... 
X-Git-Tag: master-post-reformat~547
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=f6663338cb0f5c21b8635d0b84d69554b0f51b56

Applying same fix as in dtls1_process_out_of_seq_message. A truncated DTLS fragment would cause *ok to be clear, but the return value would still be the number of bytes read.

Problem identified by Emilia Käsper, based on previous issue/patch by Adam
Langley.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
---

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 29df26e99a..c195ee0f55 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -668,7 +668,9 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
 	/* read the body of the fragment (header has already been read */
 	i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
 		frag->fragment + msg_hdr->frag_off,frag_len,0);
-	if (i<=0 || (unsigned long)i!=frag_len)
+	if ((unsigned long)i!=frag_len)
+		i=-1;
+	if (i<=0)
 		goto err;
 
 	RSMBLY_BITMASK_MARK(frag->reassembly, (long)msg_hdr->frag_off,