SSL_new() may potentially add a certfificate. Therefore, wen

duplicating the certificate that is in the original SSL, remove the
one that SSL_new() provided, if any.
Spotted by: Mike Zeoli <zeoli@roguewave.com>

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index c757ea874e638d885ff59f5e8985d69c0b88525a..24f314e5b93f3302cd1f053a8651df62748ec523 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -1718,6 +1718,10 @@ SSL *SSL_dup(SSL *s)
 
                if (s->cert != NULL)
                        {
+                       if (ret->cert != NULL)
+                               {
+                               ssl_cert_free(ret->cert);
+                               }
                        ret->cert = ssl_cert_dup(s->cert);
                        if (ret->cert == NULL)
                                goto err;