From 3e8b6485b342d70e980418bc4bb2c60148d844d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bodo=20M=C3=B6ller?= Date: Thu, 25 Mar 2010 11:25:30 +0000 Subject: Fix for "Record of death" vulnerability CVE-2010-0740. Also, add missing CHANGES entry for CVE-2009-3245 (code changes submitted to this branch on 23 Feb 2010), and further harmonize this version of CHANGES with the versions in the current branches. --- ssl/s3_pkt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'ssl/s3_pkt.c') diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index 9f2e16de87..b30c032b74 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -337,9 +337,9 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length); if (version != s->version) { SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER); - /* Send back error using their - * version number :-) */ - s->version=version; + if ((s->version & 0xFF00) == (version & 0xFF00)) + /* Send back error using their minor version number :-) */ + s->version = (unsigned short)version; al=SSL_AD_PROTOCOL_VERSION; goto f_err; } -- cgit v1.2.1