Commit d1e1aeef authored by David Ramos's avatar David Ramos Committed by Matt Caswell
Browse files

Delays the queue insertion until after the ssl3_setup_buffers() call due to... 

Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362
parent 72346328

ssl/d1_pkt.c

+9 −9
Original line number Diff line number Diff line
@@ -239,14 +239,6 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority) 
	}

#endif



	/* insert should not fail, since duplicates are dropped */

	if (pqueue_insert(queue->q, item) == NULL)

		{

		OPENSSL_free(rdata);

		pitem_free(item);

		return(0);

		}



	s->packet = NULL;

	s->packet_length = 0;

	memset(&(s->s3->rbuf), 0, sizeof(SSL3_BUFFER));
@@ -260,6 +252,14 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority) 
		return(0);

		}



	/* insert should not fail, since duplicates are dropped */

	if (pqueue_insert(queue->q, item) == NULL)

		{

		OPENSSL_free(rdata);

		pitem_free(item);

		return(0);

		}



	return(1);

	}