3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
46 lines
1.6 KiB
Diff
46 lines
1.6 KiB
Diff
Index: crypto/openssl/crypto/buffer/buffer.c
|
|
===================================================================
|
|
--- crypto/openssl/crypto/buffer/buffer.c (revision 234992)
|
|
+++ crypto/openssl/crypto/buffer/buffer.c (working copy)
|
|
@@ -166,7 +166,7 @@
|
|
/* This limit is sufficient to ensure (len+3)/3*4 < 2**31 */
|
|
if (len > LIMIT_BEFORE_EXPANSION)
|
|
{
|
|
- BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);
|
|
+ BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);
|
|
return 0;
|
|
}
|
|
n=(len+3)/3*4;
|
|
Index: crypto/openssl/ssl/s3_srvr.c
|
|
===================================================================
|
|
--- crypto/openssl/ssl/s3_srvr.c (revision 234992)
|
|
+++ crypto/openssl/ssl/s3_srvr.c (working copy)
|
|
@@ -698,14 +698,6 @@
|
|
int ok;
|
|
long n;
|
|
|
|
- /* We only allow the client to restart the handshake once per
|
|
- * negotiation. */
|
|
- if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
|
|
- {
|
|
- SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
|
|
- return -1;
|
|
- }
|
|
-
|
|
/* this function is called when we really expect a Certificate message,
|
|
* so permit appropriate message length */
|
|
n=s->method->ssl_get_message(s,
|
|
@@ -718,6 +710,13 @@
|
|
s->s3->tmp.reuse_message = 1;
|
|
if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
|
|
{
|
|
+ /* We only allow the client to restart the handshake once per
|
|
+ * negotiation. */
|
|
+ if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
|
|
+ {
|
|
+ SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
|
|
+ return -1;
|
|
+ }
|
|
/* Throw away what we have done so far in the current handshake,
|
|
* which will now be aborted. (A full SSL_clear would be too much.) */
|
|
#ifndef OPENSSL_NO_DH
|