Ticket #285: lighttpd-1.5-ssl-dos.patch

src/connections.c

@@ -1486 +1486 @@
 #ifdef USE_OPENSSL
                         if (srv_sock->is_ssl) {
                                 int ret;
+                                ERR_clear_error();
                                 switch ((ret = SSL_shutdown(con->sock->ssl))) {
                                 case 1:
                                         /* ok */

src/network_openssl.c

@@ -40 +40 @@
         UNUSED(srv);
         UNUSED(con);
 
+        ERR_clear_error();
         do {
                 int oerrno;
                 b = chunkqueue_get_append_buffer(cq);
@@ -85 +86 @@
                                 } else {
                                         switch(oerrno) {
                                         case EPIPE:
+                                                ERR_clear_error();
                                         case ECONNRESET:
                                                 return NETWORK_STATUS_CONNECTION_CLOSE;
                                         default:
@@ -183 +185 @@
                          * checking toSend and not calling SSL_write() is simpler
                          */
 
+                        ERR_clear_error();
                         if (toSend != 0 && (r = SSL_write(sock->ssl, offset, toSend)) <= 0) {
                                 unsigned long err;
 
@@ -287 +290 @@
 
                                 close(ifd);
 
+                                ERR_clear_error();
                                 if ((r = SSL_write(sock->ssl, s, toSend)) <= 0) {
                                         unsigned long err;