From a23d5e20f162564d8c13bda50ea358caaa7b047c Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 29 Apr 2025 14:21:49 +0100 Subject: [PATCH] Drop empty app data records in DTLS App data records with 0 bytes of payload will confuse callers of SSL_read(). This will cause a successful read and return 0 bytes as read. Unfortunately a 0 return from SSL_read() is considered a failure response. A subsequent call to SSL_get_error() will then give the wrong result. Zero length app data records are actually allowed by the spec, but have never been handled correctly by OpenSSL. We already disallow creating such empty app data records. Since the SSL_read() API does not have a good way to handle this type of read, we simply ignore them. Partial fix for #27316 Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27541) --- ssl/record/methods/dtls_meth.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ssl/record/methods/dtls_meth.c b/ssl/record/methods/dtls_meth.c index a69629b07b5..23715b2cc6a 100644 --- a/ssl/record/methods/dtls_meth.c +++ b/ssl/record/methods/dtls_meth.c @@ -571,6 +571,12 @@ int dtls_get_more_records(OSSL_RECORD_LAYER *rl) return OSSL_RECORD_RETURN_FATAL; } + if (rr->length == 0) { + /* No payload data in this record. Dump it */ + rl->packet_length = 0; + goto again; + } + rl->num_recs = 1; return OSSL_RECORD_RETURN_SUCCESS; } -- 2.47.2