Commit 8343e6b6 authored by David Ramos's avatar David Ramos Committed by Matt Caswell
Browse files

Delays the queue insertion until after the ssl3_setup_buffers() call due to... 

Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362
parent f87c6a55

ssl/d1_pkt.c

+8 −7
Original line number Diff line number Diff line
@@ -231,13 +231,6 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority) 


	item->data = rdata;



	/* insert should not fail, since duplicates are dropped */

	if (pqueue_insert(queue->q, item) == NULL)

		{

		OPENSSL_free(rdata);

		pitem_free(item);

		return(0);

		}



	s->packet = NULL;

	s->packet_length = 0;
@@ -252,6 +245,14 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority) 
		return(0);

		}



	/* insert should not fail, since duplicates are dropped */

	if (pqueue_insert(queue->q, item) == NULL)

		{

		OPENSSL_free(rdata);

		pitem_free(item);

		return(0);

		}

	

	return(1);

	}