commit e2f8ff67972a85bfc748b16b7128fee08c4dd4c0
author Paul Bakker <p.j.bakker@polarssl.org> Fri Apr 20 13:33:14 2012 +0000
committer Paul Bakker <p.j.bakker@polarssl.org> Fri Apr 20 13:33:14 2012 +0000
tree 2b2b7854722fa8079d2885b5fd3b6b2793438cc4
parent e2e36d31bddcda8958237173111916c624426843

 - Merged security fixes to 1.1 branch

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 44e972c..8933355 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -785,6 +785,13 @@
     /*
      * Always compute the MAC (RFC4346, CBCTIME).
      */
+    if( ssl->in_msglen <= ssl->maclen + padlen )
+    {
+        SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
+                    ssl->in_msglen, ssl->maclen, padlen ) );
+        return( POLARSSL_ERR_SSL_INVALID_MAC );
+    }
+
     ssl->in_msglen -= ( ssl->maclen + padlen );
 
     ssl->in_hdr[3] = (unsigned char)( ssl->in_msglen >> 8 );