openssl: add patch for CVE-2010-0740 ("Record of death") vulnerability

SVN-Revision: 20592

package/openssl/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openssl
 PKG_VERSION:=0.9.8m
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://www.openssl.org/source/ \

package/openssl/patches/400-cve-2010-0740.patch

@@ -0,0 +1,15 @@
+--- a/ssl/s3_pkt.c
++++ b/ssl/s3_pkt.c
+@@ -291,9 +291,9 @@ again:
+ 			if (version != s->version)
+ 				{
+ 				SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
+-				/* Send back error using their
+-				 * version number :-) */
+-				s->version=version;
++                                if ((s->version & 0xFF00) == (version & 0xFF00))
++                                	/* Send back error using their minor version number :-) */
++					s->version = (unsigned short)version;
+ 				al=SSL_AD_PROTOCOL_VERSION;
+ 				goto f_err;
+ 				}