Check result of set_protocol_version() and use the version passed as argument

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26226)

diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c
index 10d3b864d86479311d839a1971635d6080163cc2..4225ff0aafca2f4c0e10a8ebb94ce6445fc74dc4 100644 (file)
--- a/ssl/record/rec_layer_s3.c
+++ b/ssl/record/rec_layer_s3.c
@@ -1477,10 +1477,10 @@ int ssl_set_new_record_layer(SSL_CONNECTION *s, int version,
 int ssl_set_record_protocol_version(SSL_CONNECTION *s, int vers)
 {
     if (!ossl_assert(s->rlayer.rrlmethod != NULL)
-            || !ossl_assert(s->rlayer.wrlmethod != NULL))
+            || !ossl_assert(s->rlayer.wrlmethod != NULL)
+            || !s->rlayer.rrlmethod->set_protocol_version(s->rlayer.rrl, vers)
+            || !s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, vers))
         return 0;
-    s->rlayer.rrlmethod->set_protocol_version(s->rlayer.rrl, s->version);
-    s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, s->version);
 
     return 1;
 }

diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
index a7648396f22456d27197706f1a6d0796705c1f90..7a771254d9f748bfaa5fc0b2f24ba628dd3e15f5 100644 (file)
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -1857,8 +1857,12 @@ static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL_CONNECTION *s,
         /* SSLfatal already called */
         goto err;
     }
-    /* We are definitely going to be using TLSv1.3 */
-    s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, version1_3);
+
+    /* We are definitely going to be using (D)TLSv1.3 */
+    if (!s->rlayer.wrlmethod->set_protocol_version(s->rlayer.wrl, version1_3)) {
+        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
+        goto err;
+    }
 
     if (!tls_collect_extensions(s, extpkt, SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST,
                                 &extensions, NULL, 1)