Sun Feb 5 05:53:27 2017 UTC ()

Apply patch (requested by spz in ticket #1355):
Fix CVE-2017-3731.


(snj)

diff -r1.1.1.1.2.4 -r1.1.1.1.2.5 src/crypto/external/bsd/openssl/dist/crypto/evp/e_rc4_hmac_md5.c

--- src/crypto/external/bsd/openssl/dist/crypto/evp/e_rc4_hmac_md5.c 2015/07/12 18:39:14	1.1.1.1.2.4
+++ src/crypto/external/bsd/openssl/dist/crypto/evp/e_rc4_hmac_md5.c 2017/02/05 05:53:27	1.1.1.1.2.5

 @@ -257,26 +257,28 @@ static int rc4_hmac_md5_ctrl(EVP_CIPHER_
             return 1;
+        }
     case EVP_CTRL_AEAD_TLS1_AAD:
+        {
             unsigned char *p = ptr;
             unsigned int len;
             if (arg != EVP_AEAD_TLS1_AAD_LEN)
                 return -1;
             len = p[arg - 2] << 8 | p[arg - 1];
             if (!ctx->encrypt) {
                 if (len < MD5_DIGEST_LENGTH)
                     return -1;
                 len -= MD5_DIGEST_LENGTH;
                 p[arg - 2] = len >> 8;
                 p[arg - 1] = len;
+            }
             key->payload_length = len;
             key->md = key->head;
             MD5_Update(&key->md, p, arg);
             return MD5_DIGEST_LENGTH;
+        }
     default:
         return -1;
+    }