generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

RT3060: Limit the number of empty records.

Browse Source 
Limit the number of empty records that will be processed consecutively
in order to prevent ssl3_get_record from never returning.

Reported by "oftc_must_be_destroyed" and George Kadianakis.

Reviewed-by: Bodo Moeller <bodo@openssl.org>
This commit is contained in:
Adam Langley 2014-08-19 17:57:53 +02:00 committed by Emilia Kasper
parent e19c93811f
commit 3aac17a82f
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
ssl/s3_pkt.c
View File

@ -287,6 +287,12 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
return(n);
}
/* MAX_EMPTY_RECORDS defines the number of consecutive, empty records that will
* be processed per call to ssl3_get_record. Without this limit an attacker
* could send empty records at a faster rate than we can process and cause
* ssl3_get_record to loop forever. */
#define MAX_EMPTY_RECORDS 32
/* Call this to get a new input record.
* It will return <= 0 if more data is needed, normally due to an error
* or non-blocking IO.
@ -307,6 +313,7 @@ static int ssl3_get_record(SSL *s)
short version;
unsigned mac_size, orig_len;
size_t extra;
unsigned empty_record_count = 0;
rr= &(s->s3->rrec);
sess=s->session;
@ -539,7 +546,17 @@ printf("\n");
s->packet_length=0;
/* just read a 0 length packet */
if (rr->length == 0) goto again;
if (rr->length == 0)
{
empty_record_count++;
if (empty_record_count > MAX_EMPTY_RECORDS)
{
al=SSL_AD_UNEXPECTED_MESSAGE;
SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_RECORD_TOO_SMALL);
goto f_err;
}
goto again;
}
#if 0
fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length);