From: Dr. Matthias St. Pierre <matthias.st.pierre@ncp-e.com>
Date: Wed, 6 May 2020 15:24:13 +0000 (+0200)
Subject: Fix use-after-free in BIO_C_SET_SSL callback
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=d07e8b0ae66e96cda9c803de36e977fb7dfe941a;p=oweals%2Fopenssl.git

Fix use-after-free in BIO_C_SET_SSL callback

Since the BIO_SSL structure was renewed by `ssl_free(b)/ssl_new(b)`,
the `bs` pointer needs to be updated before assigning to `bs->ssl`.

Thanks to @suishixingkong for reporting the issue and providing a fix.

Closes #10539

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11746)

(cherry picked from commit 73d6b4efe6835a6c97ce61df6bf339b0903e5b7a)
---

diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c
index ab9e6668cd..efa23bf1b1 100644
--- a/ssl/bio_ssl.c
+++ b/ssl/bio_ssl.c
@@ -284,6 +284,7 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
             ssl_free(b);
             if (!ssl_new(b))
                 return 0;
+            bs = BIO_get_data(b);
         }
         BIO_set_shutdown(b, num);
         ssl = (SSL *)ptr;