Commit 13ed1afa authored by Bernd Edlinger's avatar Bernd Edlinger Committed by Rich Salz
Browse files

Avoid questionable use of the value of a pointer that refers to space 


deallocated by a call to the free function in tls_decrypt_ticket.

Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2897)
parent a78d043b

ssl/t1_lib.c

+2 −1
Original line number Diff line number Diff line
@@ -3170,10 +3170,11 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, 
    p = sdec;



    sess = d2i_SSL_SESSION(NULL, &p, slen);

    slen -= p - sdec;

    OPENSSL_free(sdec);

    if (sess) {

        /* Some additional consistency checks */

        if (p != sdec + slen || sess->session_id_length != 0) {

        if (slen != 0 || sess->session_id_length != 0) {

            SSL_SESSION_free(sess);

            return 2;

        }