svn commit: r196461 - in vendor-crypto/openssl/dist: crypto/pqueue ssl

[Simon L. Nielsen]

Author: simon
Date: Sun Aug 23 13:58:25 2009
New Revision: 196461
URL: http://svn.freebsd.org/changeset/base/196461

Log:
  Import DTLS fix from upstream OpenSSL 0.9.8 branch:
  
  Fix memory consumption bug with "future epoch" DTLS records.
  
  Note that this will not get FreeBSD Security Advisory as DTLS is
  experimental in OpenSSL.
  
  Security:	CVE-2009-1377
  Obtained from:	OpenSSL CVS
  		http://cvs.openssl.org/chngview?cn=18187

Modified:
  vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c
  vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h
  vendor-crypto/openssl/dist/ssl/d1_pkt.c

Modified: vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c
==============================================================================
--- vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c	Sun Aug 23 12:44:15 2009	(r196460)
+++ vendor-crypto/openssl/dist/crypto/pqueue/pqueue.c	Sun Aug 23 13:58:25 2009	(r196461)
@@ -234,3 +234,17 @@ pqueue_next(pitem **item)
 
 	return ret;
 	}
+
+int
+pqueue_size(pqueue_s *pq)
+{
+	pitem *item = pq->items;
+	int count = 0;
+	
+	while(item != NULL)
+	{
+		count++;
+		item = item->next;
+	}
+	return count;
+}

Modified: vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h
==============================================================================
--- vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h	Sun Aug 23 12:44:15 2009	(r196460)
+++ vendor-crypto/openssl/dist/crypto/pqueue/pqueue.h	Sun Aug 23 13:58:25 2009	(r196461)
@@ -91,5 +91,6 @@ pitem *pqueue_iterator(pqueue pq);
 pitem *pqueue_next(piterator *iter);
 
 void   pqueue_print(pqueue pq);
+int    pqueue_size(pqueue pq);
 
 #endif /* ! HEADER_PQUEUE_H */

Modified: vendor-crypto/openssl/dist/ssl/d1_pkt.c
==============================================================================
--- vendor-crypto/openssl/dist/ssl/d1_pkt.c	Sun Aug 23 12:44:15 2009	(r196460)
+++ vendor-crypto/openssl/dist/ssl/d1_pkt.c	Sun Aug 23 13:58:25 2009	(r196461)
@@ -167,6 +167,10 @@ dtls1_buffer_record(SSL *s, record_pqueu
     DTLS1_RECORD_DATA *rdata;
 	pitem *item;
 
+	/* Limit the size of the queue to prevent DOS attacks */
+	if (pqueue_size(queue->q) >= 100)
+		return 0;
+		
 	rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
 	item = pitem_new(priority, rdata);
 	if (rdata == NULL || item == NULL)