diff options
| author | Adam Langley <agl@imperialviolet.org> | 2014-06-07 01:19:21 +0400 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2014-08-07 22:12:41 +0400 |
| commit | d06afe40ab84e3a99b90302399092ec4691a4fc1 (patch) | |
| tree | a4282d607f4cfd6acae037fc35a715752f6ee532 /ssl/d1_both.c | |
| parent | eeb9f491e8f07a3160df6c586a5bde42ebceb672 (diff) | |
Avoid double free when processing DTLS packets.
The |item| variable, in both of these cases, may contain a pointer to a
|pitem| structure within |s->d1->buffered_messages|. It was being freed
in the error case while still being in |buffered_messages|. When the
error later caused the |SSL*| to be destroyed, the item would be double
freed.
Thanks to Wah-Teh Chang for spotting that the fix in 1632ef74 was
inconsistent with the other error paths (but correct).
Fixes CVE-2014-3505
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(Imported from upstream's 49850075555893c9c60d5b981deb697f3b9515ea)
Change-Id: Ie40007184f6194ba032b4213c18d36254e80aaa6
Reviewed-on: https://boringssl-review.googlesource.com/1432
Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'ssl/d1_both.c')
| -rw-r--r-- | ssl/d1_both.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/ssl/d1_both.c b/ssl/d1_both.c index 570514b3..fef8b45a 100644 --- a/ssl/d1_both.c +++ b/ssl/d1_both.c @@ -701,8 +701,7 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok) return DTLS1_HM_FRAGMENT_RETRY; err: - if (frag != NULL) dtls1_hm_fragment_free(frag); - if (item != NULL) OPENSSL_free(item); + if (frag != NULL && item == NULL) dtls1_hm_fragment_free(frag); *ok = 0; return i; } @@ -786,8 +785,7 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok) return DTLS1_HM_FRAGMENT_RETRY; err: - if ( frag != NULL) dtls1_hm_fragment_free(frag); - if ( item != NULL) OPENSSL_free(item); + if (frag != NULL && item == NULL) dtls1_hm_fragment_free(frag); *ok = 0; return i; } |