Skip to main content
Revision fc7804ec392fcf8051abe6bc9da9108744d2ae35 authored by Matt Caswell on 06 June 2014, 21:25:52 UTC, committed by Matt Caswell on 06 August 2014, 19:27:51 UTC
Fix DTLS handshake message size checks.
In |dtls1_reassemble_fragment|, the value of
|msg_hdr->frag_off+frag_len| was being checked against the maximum
handshake message size, but then |msg_len| bytes were allocated for the
fragment buffer. This means that so long as the fragment was within the
allowed size, the pending handshake message could consume 16MB + 2MB
(for the reassembly bitmap). Approx 10 outstanding handshake messages
are allowed, meaning that an attacker could consume ~180MB per DTLS
connection.

In the non-fragmented path (in |dtls1_process_out_of_seq_message|), no
check was applied.

Fixes CVE-2014-3506

Wholly based on patch by Adam Langley with one minor amendment.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
1 parent e7b9d9b
Raw File
sgiccbug.c
/* NOCW */
/* sgibug.c */
/* bug found by Eric Young (eay@mincom.oz.au) May 95 */

#include <stdio.h>

/* This compiler bug it present on IRIX 5.3, 5.1 and 4.0.5 (these are
 * the only versions of IRIX I have access to.
 * defining FIXBUG removes the bug.
 * (bug is still present in IRIX 6.3 according to
 * Gage <agage@forgetmenot.Mines.EDU>
 */
 
/* Compare the output from
 * cc sgiccbug.c; ./a.out
 * and
 * cc -O sgiccbug.c; ./a.out
 */

static unsigned long a[4]={0x01234567,0x89ABCDEF,0xFEDCBA98,0x76543210};
static unsigned long b[4]={0x89ABCDEF,0xFEDCBA98,0x76543210,0x01234567};
static unsigned long c[4]={0x77777778,0x8ACF1357,0x88888888,0x7530ECA9};

main()
	{
	unsigned long r[4];
	sub(r,a,b);
	fprintf(stderr,"input a= %08X %08X %08X %08X\n",a[3],a[2],a[1],a[0]);
	fprintf(stderr,"input b= %08X %08X %08X %08X\n",b[3],b[2],b[1],b[0]);
	fprintf(stderr,"output = %08X %08X %08X %08X\n",r[3],r[2],r[1],r[0]);
	fprintf(stderr,"correct= %08X %08X %08X %08X\n",c[3],c[2],c[1],c[0]);
	}

int sub(r,a,b)
unsigned long *r,*a,*b;
	{
	register unsigned long t1,t2,*ap,*bp,*rp;
	int i,carry;
#ifdef FIXBUG
	unsigned long dummy;
#endif

	ap=a;
	bp=b;
	rp=r;
	carry=0;
	for (i=0; i<4; i++)
		{
		t1= *(ap++);
		t2= *(bp++);
		t1=(t1-t2);
#ifdef FIXBUG
		dummy=t1;
#endif
		*(rp++)=t1&0xffffffff;
		}
	}
back to top