[openssl-commits] [openssl] OpenSSL_1_0_1-stable update

[Matt Caswell]

The branch OpenSSL_1_0_1-stable has been updated
       via  75077a2277f95cc293e1f5d0538b426ae5e99e6f (commit)
      from  c62592e52f38280e9e31cd42e7a77cf2604518a1 (commit)


- Log -----------------------------------------------------------------
commit 75077a2277f95cc293e1f5d0538b426ae5e99e6f
Author: Matt Caswell <matt at openssl.org>
Date:   Sat May 23 21:51:21 2015 +0100

    Don't send an alert if we've just received one
    
    If the record received is for a version that we don't support, previously we
    were sending an alert back. However if the incoming record already looks
    like an alert then probably we shouldn't do that. So suppress an outgoing
    alert if it looks like we've got one incoming.
    
    Reviewed-by: Kurt Roeckx <kurt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_pkt.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 7c9f20c..25cf929 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -347,11 +347,22 @@ static int ssl3_get_record(SSL *s)
             if (version != s->version) {
                 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
                 if ((s->version & 0xFF00) == (version & 0xFF00)
-                    && !s->enc_write_ctx && !s->write_hash)
+                    && !s->enc_write_ctx && !s->write_hash) {
+                    if (rr->type == SSL3_RT_ALERT) {
+                        /*
+                         * The record is using an incorrect version number, but
+                         * what we've got appears to be an alert. We haven't
+                         * read the body yet to check whether its a fatal or
+                         * not - but chances are it is. We probably shouldn't
+                         * send a fatal alert back. We'll just end.
+                         */
+                         goto err;
+                    }
                     /*
                      * Send back error using their minor version number :-)
                      */
                     s->version = (unsigned short)version;
+                }
                 al = SSL_AD_PROTOCOL_VERSION;
                 goto f_err;
             }