Use a flag in SSL3_BUFFER to track when an application buffer is reused.
authorJohn Baldwin <jhb@FreeBSD.org>
Wed, 20 Nov 2019 21:40:12 +0000 (13:40 -0800)
committerTomas Mraz <tmraz@fedoraproject.org>
Mon, 16 Mar 2020 09:41:51 +0000 (10:41 +0100)
commit074a6e86e695d9f2dadf9b4ffe405c2eed24fbdc
tree02ae0db68efd6c5ed133fe6acb833f8e2159d7e0
parentb1f79e7ce54afc28bfb5dfcfdd379782ed501b0a
Use a flag in SSL3_BUFFER to track when an application buffer is reused.

With KTLS, writes to an SSL connection store the application buffer
pointer directly in the 'buf' member instead of allocating a separate
buffer to hold the encrypted data.  As a result,
ssl3_release_write_buffer() has to avoid freeing these 'buf' pointers.

Previously, ssl3_release_write_buffer() checked for KTLS being enabled
on the write BIO to determine if a buffer should be freed.  However, a
buffer can outlive a BIO.  For example, 'openssl s_time' creates new
write BIOs when reusing sessions.  Since the new BIO did not have KTLS
enabled at the start of a connection, ssl3_release_write_buffer()
would incorrectly try to free the 'buf' pointer from the previous KTLS
connection.  To fix, track the state of 'buf' explicitly in
SSL3_BUFFER to determine if the 'buf' should be freed or simply
cleared.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/10489)
ssl/record/rec_layer_s3.c
ssl/record/record.h
ssl/record/record_local.h
ssl/record/ssl3_buffer.c