Commit 9c2d0cd1 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

PR: 2314 

Submitted by: Mounir IDRASSI <mounir.idrassi@idrix.net>
Reviewed by: steve

Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939
parent 0ef9b9c7

CHANGES

+3 −0
Original line number Diff line number Diff line
@@ -857,6 +857,9 @@ 
  

 Changes between 0.9.8o and 0.9.8p [xx XXX xxxx]



  *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939

     [Steve Henson]



  *) Don't reencode certificate when calculating signature: cache and use

     the original encoding instead. This makes signature verification of

     some broken encodings work correctly.

ssl/s3_clnt.c

+1 −0
Original line number Diff line number Diff line
@@ -1508,6 +1508,7 @@ int ssl3_get_key_exchange(SSL *s) 
		s->session->sess_cert->peer_ecdh_tmp=ecdh;

		ecdh=NULL;

		BN_CTX_free(bn_ctx);

		bn_ctx = NULL;

		EC_POINT_free(srvr_ecpoint);

		srvr_ecpoint = NULL;

		}