diff -up openssl-1.0.1e/ssl/d1_pkt.c.many-alerts openssl-1.0.1e/ssl/d1_pkt.c

--- openssl-1.0.1e/ssl/d1_pkt.c.many-alerts	2016-10-04 16:12:30.000000000 +0200

+++ openssl-1.0.1e/ssl/d1_pkt.c	2016-11-01 10:48:05.270349440 +0100

@@ -915,6 +915,13 @@ start:

 		goto start;

 		}

+	/*

+	 * Reset the count of consecutive warning alerts if we've got a non-empty

+	 * record that isn't an alert.

+	 */

+	if (rr->type != SSL3_RT_ALERT && rr->length != 0)

+		s->cert->alert_count = 0;

+

 	/* we now have a packet which can be read and processed */

 	if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,

@@ -1184,6 +1191,15 @@ start:

 		if (alert_level == 1) /* warning */

 			{

 			s->s3->warn_alert = alert_descr;

+

+			s->cert->alert_count++;

+			if (s->cert->alert_count == MAX_WARN_ALERT_COUNT)

+				{

+				al = SSL_AD_UNEXPECTED_MESSAGE;

+				SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_TOO_MANY_WARN_ALERTS);

+				goto f_err;

+				}

+

 			if (alert_descr == SSL_AD_CLOSE_NOTIFY)

 				{

 #ifndef OPENSSL_NO_SCTP

diff -up openssl-1.0.1e/ssl/ssl_err.c.many-alerts openssl-1.0.1e/ssl/ssl_err.c

--- openssl-1.0.1e/ssl/ssl_err.c.many-alerts	2016-10-04 16:12:30.000000000 +0200

+++ openssl-1.0.1e/ssl/ssl_err.c	2016-11-01 10:54:04.673900027 +0100

@@ -552,6 +552,7 @@ static ERR_STRING_DATA SSL_str_reasons[]

 {ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),"tls invalid ecpointformat list"},

 {ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST),"tls peer did not respond with certificate list"},

 {ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG),"tls rsa encrypted value length is wrong"},

+{ERR_REASON(SSL_R_TOO_MANY_WARN_ALERTS), "too many warn alerts"},

 {ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER),"tried to use unsupported cipher"},

 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS),"unable to decode dh certs"},

 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS),"unable to decode ecdh certs"},

diff -up openssl-1.0.1e/ssl/ssl.h.many-alerts openssl-1.0.1e/ssl/ssl.h

--- openssl-1.0.1e/ssl/ssl.h.many-alerts	2016-10-04 16:12:30.000000000 +0200

+++ openssl-1.0.1e/ssl/ssl.h	2016-11-01 10:52:48.442086392 +0100

@@ -2474,6 +2474,7 @@ void ERR_load_SSL_strings(void);

 #define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST		 157

 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233

 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG	 234

+#define SSL_R_TOO_MANY_WARN_ALERTS                       409

 #define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER		 235

 #define SSL_R_UNABLE_TO_DECODE_DH_CERTS			 236

 #define SSL_R_UNABLE_TO_DECODE_ECDH_CERTS		 313

diff -up openssl-1.0.1e/ssl/ssl_locl.h.many-alerts openssl-1.0.1e/ssl/ssl_locl.h

--- openssl-1.0.1e/ssl/ssl_locl.h.many-alerts	2016-10-04 16:12:30.000000000 +0200

+++ openssl-1.0.1e/ssl/ssl_locl.h	2016-11-01 10:55:39.171148215 +0100

@@ -485,6 +485,8 @@ typedef struct cert_pkey_st

 	const EVP_MD *digest;

 	} CERT_PKEY;

+# define MAX_WARN_ALERT_COUNT    5

+

 typedef struct cert_st

 	{

 	/* Current active set */

@@ -516,6 +518,7 @@ typedef struct cert_st

 	CERT_PKEY pkeys[SSL_PKEY_NUM];

 	int references; /* >1 only if SSL_copy_session_id is used */

+	unsigned int alert_count;

 	} CERT;

diff -up openssl-1.0.1e/ssl/s3_pkt.c.many-alerts openssl-1.0.1e/ssl/s3_pkt.c

--- openssl-1.0.1e/ssl/s3_pkt.c.many-alerts	2016-10-04 16:12:30.000000000 +0200

+++ openssl-1.0.1e/ssl/s3_pkt.c	2016-11-01 10:51:21.504018044 +0100

@@ -1009,6 +1009,13 @@ start:

 		if (ret <= 0) return(ret);

 		}

+	/*

+	 * Reset the count of consecutive warning alerts if we've got a non-empty

+	 * record that isn't an alert.

+	 */

+	if (rr->type != SSL3_RT_ALERT && rr->length != 0)

+		s->cert->alert_count = 0;

+

 	/* we now have a packet which can be read and processed */

 	if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,

@@ -1225,6 +1232,15 @@ start:

 		if (alert_level == 1) /* warning */

 			{

 			s->s3->warn_alert = alert_descr;

+

+			s->cert->alert_count++;

+			if (s->cert->alert_count == MAX_WARN_ALERT_COUNT)

+				{

+				al = SSL_AD_UNEXPECTED_MESSAGE;

+				SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_TOO_MANY_WARN_ALERTS);

+				goto f_err;

+				}

+

 			if (alert_descr == SSL_AD_CLOSE_NOTIFY)

 				{

 				s->shutdown |= SSL_RECEIVED_SHUTDOWN;