commit dedce0c35cf56353050c5406fc6a7fcd37554006
author Paul Bakker <p.j.bakker@polarssl.org> Tue Apr 08 14:36:50 2014 +0200
committer Paul Bakker <p.j.bakker@polarssl.org> Tue Jul 08 14:36:12 2014 +0200
tree 58838bd2e84aa08ff329cf7e9c80ed7017138ca6
parent 6995efe8be2a20723ee391494e7d2910b667834d

Prevent potential NULL pointer dereference in ssl_read_record()

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 2a7134d..bb08fcd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,8 @@
      attack was already impossible when authentication is required).
    * Check notBefore timestamp of certificates and CRLs from the future.
    * Forbid sequence number wrapping
+   * Prevent potential NULL pointer dereference in ssl_read_record() (found by
+     TrustInSoft)
 
 Bugfix
    * Fixed X.509 hostname comparison (with non-regular characters)

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 95ee967..9c896b3 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1922,7 +1922,8 @@
             return( POLARSSL_ERR_SSL_INVALID_RECORD );
         }
 
-        ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
+        if( ssl->state != SSL_HANDSHAKE_OVER )
+            ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
 
         return( 0 );
     }