1 files changed, 0 insertions, 51 deletions
diff --git a/main/openssl/CVE-2016-6302.patch b/main/openssl/CVE-2016-6302.patch
deleted file mode 100644
index fde58dee9b..0000000000
--- a/main/openssl/CVE-2016-6302.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From baaabfd8fdcec04a691695fad9a664bea43202b6 Mon Sep 17 00:00:00 2001
-From: "Dr. Stephen Henson" <steve@openssl.org>
-Date: Tue, 23 Aug 2016 18:14:54 +0100
-Subject: [PATCH] Sanity check ticket length.
-
-If a ticket callback changes the HMAC digest to SHA512 the existing
-sanity checks are not sufficient and an attacker could perform a DoS
-attack with a malformed ticket. Add additional checks based on
-HMAC size.
-
-Thanks to Shi Lei for reporting this bug.
-
-CVE-2016-6302
-
-Reviewed-by: Rich Salz <rsalz@openssl.org>
----
- ssl/t1_lib.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
-index 7d322d0..fbcf2e6 100644
---- a/ssl/t1_lib.c
-+++ b/ssl/t1_lib.c
-@@ -3401,9 +3401,7 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick,
-     HMAC_CTX hctx;
-     EVP_CIPHER_CTX ctx;
-     SSL_CTX *tctx = s->initial_ctx;
--    /* Need at least keyname + iv + some encrypted data */
--    if (eticklen < 48)
--        return 2;
-+
-     /* Initialize session ticket encryption and HMAC contexts */
-     HMAC_CTX_init(&hctx);
-     EVP_CIPHER_CTX_init(&ctx);
-@@ -3437,6 +3435,13 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick,
-     if (mlen < 0) {
-         goto err;
-     }
-+    /* Sanity check ticket length: must exceed keyname + IV + HMAC */
-+    if (eticklen <= 16 + EVP_CIPHER_CTX_iv_length(&ctx) + mlen) {
-+        HMAC_CTX_cleanup(&hctx);
-+        EVP_CIPHER_CTX_cleanup(&ctx);
-+        return 2;
-+    }
-+
-     eticklen -= mlen;
-     /* Check HMAC of encrypted ticket */
-     if (HMAC_Update(&hctx, etick, eticklen) <= 0
--- 
-1.9.1
-