From 4224bc0a4fd791324ac5faf0ec234be1cd0617d0 Mon Sep 17 00:00:00 2001 From: Paul Bakker Date: Tue, 8 Apr 2014 14:36:50 +0200 Subject: [PATCH] Prevent potential NULL pointer dereference in ssl_read_record() --- ChangeLog | 2 ++ library/ssl_tls.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 5fe77e4a0..f08432af6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -12,6 +12,8 @@ Security This affects certificates in the user-supplied chain except the top certificate. If the user-supplied chain contains only one certificates, it is not affected (ie, its notAfter date is properly checked). + * Prevent potential NULL pointer dereference in ssl_read_record() (found by + TrustInSoft) Bugfix * The length of various ClientKeyExchange messages was not properly checked. diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 681b7c39d..8d4348808 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -2087,7 +2087,8 @@ int ssl_read_record( ssl_context *ssl ) return( POLARSSL_ERR_SSL_INVALID_RECORD ); } - ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen ); + if( ssl->state != SSL_HANDSHAKE_OVER ) + ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen ); return( 0 ); }