Make CBC decoding constant time.

[openssl.git] / ssl / ssl3.h

diff --git a/ssl/ssl3.h b/ssl/ssl3.h
index d2a5208824933baca05a0163809d017f6dc6cbcf..e41f2888713d865fa1606daca752e2df88ba3c3c 100644 (file)
--- a/ssl/ssl3.h
+++ b/ssl/ssl3.h
@@ -372,6 +372,10 @@ typedef struct ssl3_record_st
 /*r */ unsigned char *comp;    /* only used with decompression - malloc()ed */
 /*r */  unsigned long epoch;    /* epoch number, needed by DTLS1 */
 /*r */  unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */
+/*rw*/ unsigned int orig_len;  /* How many bytes were available before padding
+                                  was removed? This is used to implement the
+                                  MAC check in constant time for CBC records.
+                                */
        } SSL3_RECORD;
 
 typedef struct ssl3_buffer_st