KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

openssl: add patch for CVE-2010-0740 ("Record of death") vulnerability

Browse source 
SVN-Revision: 20592
This commit is contained in:
Jo-Philipp Wich 2010-03-29 23:14:47 +00:00
parent dc4712f887
commit 30edff3c2f
2 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package/openssl/Makefile
View file

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=openssl PKG_NAME:=openssl
PKG_VERSION:=0.9.8m PKG_VERSION:=0.9.8m
PKG_RELEASE:=2 PKG_RELEASE:=3
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://www.openssl.org/source/ \ PKG_SOURCE_URL:=http://www.openssl.org/source/ \

15
package/openssl/patches/400-cve-2010-0740.patch Normal file
View file

@ -0,0 +1,15 @@
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -291,9 +291,9 @@ again:
if (version != s->version)
{
SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
- /* Send back error using their
- * version number :-) */
- s->version=version;
+ if ((s->version & 0xFF00) == (version & 0xFF00))
+ /* Send back error using their minor version number :-) */
+ s->version = (unsigned short)version;
al=SSL_AD_PROTOCOL_VERSION;
goto f_err;
}