Allocate extra space when NETSCAPE_HANG_BUG defined.

Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
(cherry picked from commit 673c42b2380c34e7500f05e7f00c674cc677a065)

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 59ca04a0fd205597d2e2c205de75d9703d07e5c5..06c7b008e51cf91b4f5e637ab36f4f4f65a1ade4 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -1762,6 +1762,11 @@ int ssl3_send_certificate_request(SSL *s)
                s->init_num=n+4;
                s->init_off=0;
 #ifdef NETSCAPE_HANG_BUG
+               if (!BUF_MEM_grow_clean(buf, s->init_num + 4))
+                       {
+                       SSLerr(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,ERR_R_BUF_LIB);
+                       goto err;
+                       }
                p=(unsigned char *)s->init_buf->data + s->init_num;
 
                /* do the header */