diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2014-05-29 15:00:05 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2014-06-05 09:04:27 +0100 |
| commit | 8011cd56e39a433b1837465259a9bd24a38727fb (patch) | |
| tree | 105985fdc332e7d4848cf2782de06c8196bab37d | |
| parent | d3152655d5319ce883c8e3ac4b99f8de4c59d846 (diff) | |
| download | openssl-new-8011cd56e39a433b1837465259a9bd24a38727fb.tar.gz | |
Fix CVE-2014-3470
Check session_cert is not NULL before dereferencing it.
| -rw-r--r-- | ssl/s3_clnt.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index c99a4c495e..0457af8789 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -2512,6 +2512,13 @@ int ssl3_send_client_key_exchange(SSL *s) int ecdh_clnt_cert = 0; int field_size = 0; + if (s->session->sess_cert == NULL) + { + ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE); + SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE); + goto err; + } + /* Did we send out the client's * ECDH share for use in premaster * computation as part of client certificate? |