Skip to main content
Revision b095884a58876ccd3e65f620b7f80d61b4bce687 authored by Matt Caswell on 07 January 2015, 14:18:13 UTC, committed by Matt Caswell on 08 January 2015, 14:14:56 UTC
A memory leak can occur in dtls1_buffer_record if either of the calls to
ssl3_setup_buffers or pqueue_insert fail. The former will fail if there is a
malloc failure, whilst the latter will fail if attempting to add a duplicate
record to the queue. This should never happen because duplicate records should
be detected and dropped before any attempt to add them to the queue.
Unfortunately records that arrive that are for the next epoch are not being
recorded correctly, and therefore replays are not being detected.
Additionally, these "should not happen" failures that can occur in
dtls1_buffer_record are not being treated as fatal and therefore an attacker
could exploit this by sending repeated replay records for the next epoch,
eventually causing a DoS through memory exhaustion.

Thanks to Chris Mueller for reporting this issue and providing initial
analysis and a patch. Further analysis and the final patch was performed by
Matt Caswell from the OpenSSL development team.

CVE-2015-0206

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
(cherry picked from commit 652ff0f4796eecd8729b4690f2076d1c7ccb2862)
1 parent f7fe3d2
Raw File
pod2mantest
#!/bin/sh

# This script is used by test/Makefile to check whether a sane 'pod2man'
# is installed.
# ('make install' should not try to run 'pod2man' if it does not exist or if
# it is a broken 'pod2man' version that is known to cause trouble. if we find
# the system 'pod2man' to be broken, we use our own copy instead)
#
# In any case, output an appropriate command line for running (or not
# running) pod2man.


IFS=:
if test "$OSTYPE" = "msdosdjgpp"; then IFS=";"; fi

try_without_dir=true
# First we try "pod2man", then "$dir/pod2man" for each item in $PATH.
for dir in dummy${IFS}$PATH; do
    if [ "$try_without_dir" = true ]; then
      # first iteration
      pod2man=pod2man
      try_without_dir=false
    else
      # second and later iterations
      pod2man="$dir/pod2man"
      if [ ! -f "$pod2man" ]; then  # '-x' is not available on Ultrix
        pod2man=''
      fi
    fi

    if [ ! "$pod2man" = '' ]; then
        failure=none

	if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | fgrep OpenSSL >/dev/null; then
	    :
	else
	    failure=BasicTest
	fi

	if [ "$failure" = none ]; then
	    if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | grep '^MARKER - ' >/dev/null; then
	        failure=MultilineTest
	    fi
	fi


        if [ "$failure" = none ]; then
            echo "$pod2man"
            exit 0
        fi

        echo "$pod2man does not work properly ('$failure' failed).  Looking for another pod2man ..." >&2
    fi
done

echo "No working pod2man found.  Consider installing a new version." >&2
echo "As a workaround, we'll use a bundled old copy of pod2man.pl." >&2
echo "$1 ../../util/pod2man.pl"
back to top