Update from 1.0.0-stable

[openssl.git] / ssl / d1_pkt.c

diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index b53e07d23c2a4ce869e71ae54c160068c390d54a..35e83d8b52dc8e383d60890b861d3c5039873b80 100644 (file)
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -207,6 +207,10 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
        DTLS1_RECORD_DATA *rdata;
        pitem *item;
 
+       /* Limit the size of the queue to prevent DOS attacks */
+       if (pqueue_size(queue->q) >= 100)
+               return 0;
+               
        rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
        item = pitem_new(priority, rdata);
        if (rdata == NULL || item == NULL)
@@ -619,6 +623,7 @@ again:
                /* this packet contained a partial record, dump it */
                if ( n != i)
                        {
+                       rr->length = 0;
                        s->packet_length = 0;
                        goto again;
                        }
@@ -632,6 +637,7 @@ again:
        bitmap = dtls1_get_bitmap(s, rr, &is_next_epoch);
        if ( bitmap == NULL)
                {
+               rr->length = 0;
                s->packet_length = 0;  /* dump this record */
                goto again;   /* get another record */
                }
@@ -656,6 +662,7 @@ again:
                {
                dtls1_record_bitmap_update(s, bitmap);
                dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num);
+               rr->length = 0;
                s->packet_length = 0;
                goto again;
                }
@@ -1098,6 +1105,16 @@ start:
                        s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, 
                                rr->data, 1, s, s->msg_callback_arg);
 
+               /* We can't process a CCS now, because previous handshake
+                * messages are still missing, so just drop it.
+                */
+               if (!s->d1->change_cipher_spec_ok)
+                       {
+                       goto start;
+                       }
+
+               s->d1->change_cipher_spec_ok = 0;
+
                s->s3->change_cipher_spec=1;
                if (!ssl3_do_change_cipher_spec(s))
                        goto err;