From 17160033765480453be0a41335fa6b833691c049 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilia=20K=C3=A4sper?= Date: Thu, 24 Jul 2014 22:15:29 +0200 Subject: [PATCH] Fix DTLS anonymous EC(DH) denial of service CVE-2014-3510 Reviewed-by: Dr. Stephen Henson --- ssl/s3_clnt.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 9a94de00d8..0a006a7534 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -2385,6 +2385,13 @@ int ssl3_send_client_key_exchange(SSL *s) RSA *rsa; unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH]; + if (s->session->sess_cert == NULL) + { + /* We should always have a server certificate with SSL_kRSA. */ + SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR); + goto err; + } + if (s->session->sess_cert->peer_rsa_tmp != NULL) rsa=s->session->sess_cert->peer_rsa_tmp; else