From: David Ramos Date: Sun, 1 Jun 2014 20:28:41 +0000 (+0100) Subject: Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after... X-Git-Tag: OpenSSL_1_0_1h~13 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=a07856a08d7e8d76273e5d05099914aa335da143;p=oweals%2Fopenssl.git Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362 --- diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index 8186462d4a..3a28e59273 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -239,14 +239,6 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority) } #endif - /* insert should not fail, since duplicates are dropped */ - if (pqueue_insert(queue->q, item) == NULL) - { - OPENSSL_free(rdata); - pitem_free(item); - return(0); - } - s->packet = NULL; s->packet_length = 0; memset(&(s->s3->rbuf), 0, sizeof(SSL3_BUFFER)); @@ -259,7 +251,15 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority) pitem_free(item); return(0); } - + + /* insert should not fail, since duplicates are dropped */ + if (pqueue_insert(queue->q, item) == NULL) + { + OPENSSL_free(rdata); + pitem_free(item); + return(0); + } + return(1); }