Commit d3bc9805 authored by Bernd Edlinger's avatar Bernd Edlinger Committed by Rich Salz
Browse files

Avoid questionable use of the value of a pointer 



that refers to space
deallocated by a call to the free function in tls_decrypt_ticket.

Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2897)
(cherry picked from commit 13ed1afa)
parent 22cef4e1

ssl/t1_lib.c

+2 −1
Original line number Diff line number Diff line
@@ -1311,10 +1311,11 @@ TICKET_RETURN tls_decrypt_ticket(SSL *s, const unsigned char *etick, 
    p = sdec;



    sess = d2i_SSL_SESSION(NULL, &p, slen);

    slen -= p - sdec;

    OPENSSL_free(sdec);

    if (sess) {

        /* Some additional consistency checks */

        if (p != sdec + slen || sess->session_id_length != 0) {

        if (slen != 0 || sess->session_id_length != 0) {

            SSL_SESSION_free(sess);

            return TICKET_NO_DECRYPT;

        }