PR: 1930

Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org

Limit size of DTLS record buffer queue.

diff --git a/crypto/pqueue/pqueue.c b/crypto/pqueue/pqueue.c
index c20bc6fc965c51ac4af8a1f6efa3c1bec8d2704a..99a6fb874dc7c6443ff201ca248b33a2327f5601 100644 (file)
--- a/crypto/pqueue/pqueue.c
+++ b/crypto/pqueue/pqueue.c
@@ -237,3 +237,17 @@ pqueue_next(pitem **item)
 
        return ret;
        }
+
+int
+pqueue_size(pqueue_s *pq)
+{
+       pitem *item = pq->items;
+       int count = 0;
+       
+       while(item != NULL)
+       {
+               count++;
+               item = item->next;
+       }
+       return count;
+}

diff --git a/crypto/pqueue/pqueue.h b/crypto/pqueue/pqueue.h
index 7a293c8584c21213702d17609cf637985fa9c748..87fc9037c8f3af30365c2cda5fcba5545ca74d87 100644 (file)
--- a/crypto/pqueue/pqueue.h
+++ b/crypto/pqueue/pqueue.h
@@ -89,5 +89,6 @@ pitem *pqueue_iterator(pqueue pq);
 pitem *pqueue_next(piterator *iter);
 
 void   pqueue_print(pqueue pq);
+int    pqueue_size(pqueue pq);
 
 #endif /* ! HEADER_PQUEUE_H */

diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index b53e07d23c2a4ce869e71ae54c160068c390d54a..a89edbc7a7179d6bda11ea284ce9938e581149d3 100644 (file)
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -207,6 +207,10 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
        DTLS1_RECORD_DATA *rdata;
        pitem *item;
 
+       /* Limit the size of the queue to prevent DOS attacks */
+       if (pqueue_size(queue->q) >= 100)
+               return 0;
+               
        rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
        item = pitem_new(priority, rdata);
        if (rdata == NULL || item == NULL)