Update from 0.9.8-stable.

[openssl.git] / ssl / s3_srvr.c

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index eaaadde3ad82e4781a1256989db9130186c40481..ffa031f61e0ca712ab1ff8ce79fc95207614a080 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1920,7 +1920,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                        }
 
                /* TLS and [incidentally] DTLS{0xFEFF} */
-               if (s->version > SSL3_VERSION)
+               if (s->version > SSL3_VERSION && s->version != DTLS1_BAD_VER)
                        {
                        n2s(p,i);
                        if (n != i+2)
@@ -2065,7 +2065,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                krb5_data               enc_pms;
                KSSL_CTX                *kssl_ctx = s->kssl_ctx;
                EVP_CIPHER_CTX          ciph_ctx;
-               EVP_CIPHER              *enc = NULL;
+               const EVP_CIPHER        *enc = NULL;
                unsigned char           iv[EVP_MAX_IV_LENGTH];
                unsigned char           pms[SSL_MAX_MASTER_KEY_LENGTH
                                               + EVP_MAX_BLOCK_LENGTH];
@@ -2080,7 +2080,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                n2s(p,i);
                enc_ticket.length = i;
 
-               if (n < enc_ticket.length + 6)
+               if (n < (long)(enc_ticket.length + 6))
                        {
                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                SSL_R_DATA_LENGTH_TOO_LONG);
@@ -2093,7 +2093,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                n2s(p,i);
                authenticator.length = i;
 
-               if (n < enc_ticket.length + authenticator.length + 6)
+               if (n < (long)(enc_ticket.length + authenticator.length + 6))
                        {
                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                SSL_R_DATA_LENGTH_TOO_LONG);
@@ -2844,7 +2844,7 @@ int ssl3_get_client_certificate(SSL *s)
        else
                {
                i=ssl_verify_cert_chain(s,sk);
-               if (!i)
+               if (i <= 0)
                        {
                        al=ssl_verify_alarm_type(s->verify_result);
                        SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);