Fix memory leak in s2_srvr.c if BUF_MEM_grow fails

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

diff --git a/ssl/s2_srvr.c b/ssl/s2_srvr.c
index 2cba426bb7efdef03b0407faa44145c012a9dee8..59ced3f3052f36e3f00a353a17f20e90a1288401 100644 (file)
--- a/ssl/s2_srvr.c
+++ b/ssl/s2_srvr.c
@@ -188,13 +188,21 @@ int ssl2_accept(SSL *s)
                        s->version=SSL2_VERSION;
                        s->type=SSL_ST_ACCEPT;
 
-                       buf=s->init_buf;
-                       if ((buf == NULL) && ((buf=BUF_MEM_new()) == NULL))
-                               { ret= -1; goto end; }
-                       if (!BUF_MEM_grow(buf,(int)
-                               SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))
-                               { ret= -1; goto end; }
-                       s->init_buf=buf;
+                       if(s->init_buf == NULL)
+                               {
+                               if ((buf=BUF_MEM_new()) == NULL)
+                                       {
+                                       ret= -1;
+                                       goto end;
+                                       }
+                               if (!BUF_MEM_grow(buf,(int) SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))
+                                       {
+                                       BUF_MEM_free(buf);
+                                       ret= -1;
+                                       goto end;
+                                       }
+                               s->init_buf=buf;
+                               }
                        s->init_num=0;
                        s->ctx->stats.sess_accept++;
                        s->handshake_func=ssl2_accept;