Potential buffer-overflow for ssl_read_record()
diff --git a/ChangeLog b/ChangeLog
index f8a46d9..88e5341 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
PolarSSL ChangeLog
+= Branch 1.1
+Security
+ * Potential buffer-overflow for ssl_read_record() (independently found by
+ both TrustInSoft and Paul Brodeur of Leviathan Security Group)
+
= Version 1.1.7 released on 2013-06-19
Changes
* HAVEGE random generator disabled by default
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 27f2172..a5d1cb1 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1159,7 +1159,7 @@
/*
* TLS encrypted messages can have up to 256 bytes of padding
*/
- if( ssl->minor_ver == SSL_MINOR_VERSION_1 &&
+ if( ssl->minor_ver >= SSL_MINOR_VERSION_1 &&
ssl->in_msglen > ssl->minlen + SSL_MAX_CONTENT_LEN + 256 )
{
SSL_DEBUG_MSG( 1, ( "bad message length" ) );