X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fd1_both.c;h=a56586f4e938ceb26a8312335feed663d6a7e1f5;hp=ebc03482f0238b81b6385f2394caa3d39726d6fd;hb=58f41a926a73bd5c49beb91991b486d4e0b544f5;hpb=81d06ef2fd64512e3833a13bedc004802003fbfa

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index ebc03482f0..a56586f4e9 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -569,9 +569,13 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
 	item = pqueue_find(s->d1->buffered_messages, seq64be);
 	
 	/* Discard the message if sequence number was already there, is
-	 * too far in the future or the fragment is already in the queue */
+	 * too far in the future, already in the queue or if we received
+	 * a FINISHED before the SERVER_HELLO, which then must be a stale
+	 * retransmit.
+	 */
 	if (msg_hdr->seq <= s->d1->handshake_read_seq ||
-		msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
+		msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL ||
+		(s->d1->handshake_read_seq == 0 && msg_hdr->type == SSL3_MT_FINISHED))
 		{
 		unsigned char devnull [256];