The buffer in ss3_read_n cannot actually occur because it is never

called with max > n when extend is set.

diff --git a/CHANGES b/CHANGES
index c1edb5c2e32747928b6c881f8ec34ed43f515b38..f3073b3ad8524708822c67e42eb9af9b13e436f2 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,9 +4,7 @@
 
  Changes between 0.9.4 and 0.9.5  [xx XXX 1999]
 
-  *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs,
-     including a possible buffer overflow when the 'read_ahead'
-     flag is set.
+  *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs.
      [Bodo Moeller]
 
   *) New function X509_CTX_rget_chain(), this returns the chain

diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 38063b50d58d1472195931283f0ce1442d1aecd6..7728284befd9c10846a0b5bc6ef7e0f2ba509f0c 100644 (file)
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -293,7 +293,7 @@ again:
                        goto f_err;
                        }
 
-               s->rstate=SSL_ST_READ_BODY;
+               /* now s->rstate == SSL_ST_READ_BODY; */
                }
 
        /* get and decode the data */