[Pkg-openssl-changes] r401 - in openssl/branches/etch: debian ssl

[Kurt Roeckx]

Author: kroeckx
Date: 2009-06-01 13:35:55 +0000 (Mon, 01 Jun 2009)
New Revision: 401

Modified:
   openssl/branches/etch/debian/changelog
   openssl/branches/etch/ssl/d1_both.c
Log:
Fix "DTLS fragment handling" (CVE-2009-1378)


Modified: openssl/branches/etch/debian/changelog
===================================================================
--- openssl/branches/etch/debian/changelog	2009-06-01 13:33:51 UTC (rev 400)
+++ openssl/branches/etch/debian/changelog	2009-06-01 13:35:55 UTC (rev 401)
@@ -1,8 +1,9 @@
 openssl (0.9.8c-4etch6) oldstable-security; urgency=low
 
   * Fix "DTLS record buffer limitation bug." (CVE-2009-1377)
+  * Fix "DTLS fragment handling" (CVE-2009-1378)
 
- -- Kurt Roeckx <kurt at roeckx.be>  Mon, 01 Jun 2009 15:32:47 +0200
+ -- Kurt Roeckx <kurt at roeckx.be>  Mon, 01 Jun 2009 15:35:41 +0200
 
 openssl (0.9.8c-4etch5) oldstable-security; urgency=low
 

Modified: openssl/branches/etch/ssl/d1_both.c
===================================================================
--- openssl/branches/etch/ssl/d1_both.c	2009-06-01 13:33:51 UTC (rev 400)
+++ openssl/branches/etch/ssl/d1_both.c	2009-06-01 13:35:55 UTC (rev 401)
@@ -561,7 +561,16 @@
 	if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
 		goto err;
 
-	if (msg_hdr->seq <= s->d1->handshake_read_seq)
+	/* Try to find item in queue, to prevent duplicate entries */
+	pq_64bit_init(&seq64);
+	pq_64bit_assign_word(&seq64, msg_hdr->seq);
+	item = pqueue_find(s->d1->buffered_messages, seq64);
+	pq_64bit_free(&seq64);
+	
+	/* Discard the message if sequence number was already there, is
+	 * too far in the future or the fragment is already in the queue */
+	if (msg_hdr->seq <= s->d1->handshake_read_seq ||
+		msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
 		{
 		unsigned char devnull [256];