func: int CVE_2014_3511_VULN_ssl23_get_client_hello(SSL *s) char buf_space [ 11 ] ; unsigned char * p , * d , * d_len , * dd ; unsigned int csl , sil , cl ; int v [ 2 ] ; if ( s -> state == SSL23_ST_SR_CLNT_HELLO_A )  if ( ! ssl3_setup_buffers ( s ) )  n = ssl23_read_bytes ( s , sizeof buf_space ); if ( n != sizeof buf_space )  p = s -> packet; if ( ( p [ 0 ] & 0x80 ) && ( p [ 2 ] == SSL2_MT_CLIENT_HELLO ) )  if ( ( p [ 3 ] == 0x00 ) && ( p [ 4 ] == 0x02 ) )  if ( p [ 3 ] == SSL3_VERSION_MAJOR )  if ( p [ 4 ] >= TLS1_VERSION_MINOR )  if ( p [ 4 ] >= TLS1_2_VERSION_MINOR && ! ( s -> options & SSL_OP_NO_TLSv1_2 ) )  s -> version = TLS1_2_VERSION; s -> state = SSL23_ST_SR_CLNT_HELLO_B; if ( p [ 4 ] >= TLS1_1_VERSION_MINOR && ! ( s -> options & SSL_OP_NO_TLSv1_1 ) )  s -> version = TLS1_1_VERSION; s -> state = SSL23_ST_SR_CLNT_HELLO_B; if ( ! ( s -> options & SSL_OP_NO_TLSv1 ) )  s -> version = TLS1_VERSION; s -> state = SSL23_ST_SR_CLNT_HELLO_B; if ( ! ( s -> options & SSL_OP_NO_SSLv3 ) )  s -> version = SSL3_VERSION; s -> state = SSL23_ST_SR_CLNT_HELLO_B; if ( ! ( s -> options & SSL_OP_NO_SSLv3 ) )  s -> version = SSL3_VERSION; s -> state = SSL23_ST_SR_CLNT_HELLO_B; if ( ( p [ 0 ] == SSL3_RT_HANDSHAKE ) && ( p [ 1 ] == SSL3_VERSION_MAJOR ) && ( p [ 5 ] == SSL3_MT_CLIENT_HELLO ) && ( ( p [ 3 ] == 0 && p [ 4 ] < 5 ) || ( p [ 9 ] >= p [ 1 ] ) ) )  v [ 0 ] = p [ 1 ]; if ( p [ 3 ] == 0 && p [ 4 ] < 6 )  if ( p [ 9 ] > SSL3_VERSION_MAJOR )  v [ 1 ] = 0xff; v [ 1 ] = p [ 10 ]; if ( v [ 1 ] >= TLS1_VERSION_MINOR )  if ( v [ 1 ] >= TLS1_2_VERSION_MINOR && ! ( s -> options & SSL_OP_NO_TLSv1_2 ) )  s -> version = TLS1_2_VERSION; if ( v [ 1 ] >= TLS1_1_VERSION_MINOR && ! ( s -> options & SSL_OP_NO_TLSv1_1 ) )  s -> version = TLS1_1_VERSION; if ( ! ( s -> options & SSL_OP_NO_TLSv1 ) )  s -> version = TLS1_VERSION; if ( ! ( s -> options & SSL_OP_NO_SSLv3 ) )  s -> version = SSL3_VERSION; if ( ! ( s -> options & SSL_OP_NO_SSLv3 ) )  s -> version = SSL3_VERSION; if ( ! ( s -> options & SSL_OP_NO_TLSv1 ) )  s -> version = TLS1_VERSION; if ( ( strncmp ( "GET " , ( char * ) p , 4 ) == 0 ) || ( strncmp ( "POST " , ( char * ) p , 5 ) == 0 ) || ( strncmp ( "HEAD " , ( char * ) p , 5 ) == 0 ) || ( strncmp ( "PUT " , ( char * ) p , 4 ) == 0 ) )  if ( strncmp ( "CONNECT" , ( char * ) p , 7 ) == 0 )  if ( FIPS_mode ( ) && ( s -> version < TLS1_VERSION ) )  if ( s -> state == SSL23_ST_SR_CLNT_HELLO_B )  p = s -> packet; v [ 0 ] = p [ 3 ]; v [ 1 ] = p [ 4 ]; n = ( ( p [ 0 ] & 0x7f ) << 8 ) | p [ 1 ]; if ( n > ( 1024 * 4 ) )  j = ssl23_read_bytes ( s , n + 2 ); if ( j <= 0 )  d = ( unsigned char * ) s -> init_buf -> data; if ( ( csl + sil + cl + 11 ) != s -> packet_length )  * ( d ++ ) = SSL3_MT_CLIENT_HELLO; d += 3; * ( d ++ ) = SSL3_VERSION_MAJOR; * ( d ++ ) = v [ 1 ]; memset ( d , 0 , SSL3_RANDOM_SIZE ); memcpy ( & ( d [ SSL3_RANDOM_SIZE - i ] ) , & ( p [ csl + sil ] ) , i ); d += SSL3_RANDOM_SIZE; * ( d ++ ) = 0; dd = d; d += 2; * ( d ++ ) = p [ i + 1 ]; * ( d ++ ) = p [ i + 2 ]; s2n ( j , dd ); * ( d ++ ) = 1; * ( d ++ ) = 0; while ( p < s -> packet + s -> packet_length )  * ( d ++ ) = * ( p ++ ); i = ( d - ( unsigned char * ) s -> init_buf -> data ) - 4; l2n3 ( ( long ) i , d_len ); s -> s3 -> tmp . message_size = i; if ( ! ssl_init_wbio_buffer ( s , 1 ) )  s -> state = SSL3_ST_SR_CLNT_HELLO_A; s -> rstate = SSL_ST_READ_HEADER; s -> packet_length = n; if ( s -> s3 -> rbuf . buf == NULL )  if ( ! ssl3_setup_read_buffer ( s ) )  s -> packet = & ( s -> s3 -> rbuf . buf [ 0 ] ); memcpy ( s -> packet , buf , n ); s -> s3 -> rbuf . left = n; s -> s3 -> rbuf . offset = 0; s -> s3 -> rbuf . left = 0; s -> s3 -> rbuf . offset = 0; if ( s -> version == TLS1_2_VERSION )  s -> method = TLSv1_2_server_method ( ); if ( s -> version == TLS1_1_VERSION )  if ( s -> version == TLS1_VERSION )  s -> handshake_func = s -> method -> ssl_accept; s -> init_num = 0; return ( SSL_accept ( s ) ) ; 