Looking at the diff between the two versions released by apple http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c h

Looking at the diff between the two versions released by apple http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c http://opensource.apple.com/source/Security/Security-55471/l... and http://opensource.apple.com/source/Security/Security-55179.13/libsecurity_ssl/lib/sslKeyExchange.c http://opensource.apple.com/source/Security/Security-55179.1... the only thing that changed in the relevant part was that "goto fail;" was added. @@ -627,6 +628,7 @@ goto fail; if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) goto fail; + goto fail; if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0) goto fail; this makes a copy & paste error highly unlikely.