From 5a91d3888832d96400630e76a15121ead56aeeec Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Fri, 9 Feb 2018 18:09:59 +0100 Subject: [PATCH] Swap the check in ssl3_write_pending to avoid using the possibly indeterminate pointer value in wpend_buf. Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/5307) --- ssl/record/rec_layer_s3.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c index 3a0ed744ab..3cfefb3f0f 100644 --- a/ssl/record/rec_layer_s3.c +++ b/ssl/record/rec_layer_s3.c @@ -894,10 +894,9 @@ int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, SSL3_BUFFER *wb = s->rlayer.wbuf; unsigned int currbuf = 0; -/* XXXX */ if ((s->rlayer.wpend_tot > (int)len) - || ((s->rlayer.wpend_buf != buf) && - !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) + || (!(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) + && (s->rlayer.wpend_buf != buf)) || (s->rlayer.wpend_type != type)) { SSLerr(SSL_F_SSL3_WRITE_PENDING, SSL_R_BAD_WRITE_RETRY); return (-1); -- 2.25.1