0.9.8 version of PR#1931 fix.
[openssl.git] / ssl / d1_both.c
index 5727c73776be506377ef2b9ec39c63091caaf22b..fb74ed2763fd76ac10c76a2340e2cd272ed2cca2 100644 (file)
@@ -561,7 +561,16 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
        if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
                goto err;
 
-       if (msg_hdr->seq <= s->d1->handshake_read_seq)
+       /* Try to find item in queue, to prevent duplicate entries */
+       pq_64bit_init(&seq64);
+       pq_64bit_assign_word(&seq64, msg_hdr->seq);
+       item = pqueue_find(s->d1->buffered_messages, seq64);
+       pq_64bit_free(&seq64);
+       
+       /* Discard the message if sequence number was already there, is
+        * too far in the future or the fragment is already in the queue */
+       if (msg_hdr->seq <= s->d1->handshake_read_seq ||
+               msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
                {
                unsigned char devnull [256];