From 02f873c5410e8b96c6a55cc906b8f10cd84b0835 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Fri, 22 Jul 2016 16:02:07 +0100 Subject: [PATCH] Send alert for bad DH CKE RT#4511 Reviewed-by: Matt Caswell --- ssl/s3_srvr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index 803afd8fa4..c95d6102fa 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -2325,7 +2325,8 @@ int ssl3_get_client_key_exchange(SSL *s) if (!(s->options & SSL_OP_SSLEAY_080_CLIENT_DH_BUG)) { SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG); - goto err; + al = SSL_AD_HANDSHAKE_FAILURE; + goto f_err; } else { p -= 2; i = (int)n; @@ -2378,9 +2379,10 @@ int ssl3_get_client_key_exchange(SSL *s) i = DH_compute_key(p, pub, dh_srvr); if (i <= 0) { + al = SSL_AD_HANDSHAKE_FAILURE; SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB); BN_clear_free(pub); - goto err; + goto f_err; } DH_free(s->s3->tmp.dh); -- 2.40.0