From a073129293fd1cc0dbb1325d36fa85eb3190feb0 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sun, 10 Oct 2010 12:21:23 +0000 Subject: [PATCH] PR: 2314 Submitted by: Mounir IDRASSI Reviewed by: steve Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 --- CHANGES | 3 +++ ssl/s3_clnt.c | 1 + 2 files changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index a083afc6e2..23f145ca36 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,9 @@ Changes between 0.9.8o and 0.9.8p [xx XXX xxxx] + *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 + [Steve Henson] + *) Don't reencode certificate when calculating signature: cache and use the original encoding instead. This makes signature verification of some broken encodings work correctly. diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index b0d49d8cd3..f0995b96ac 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -1376,6 +1376,7 @@ int ssl3_get_key_exchange(SSL *s) s->session->sess_cert->peer_ecdh_tmp=ecdh; ecdh=NULL; BN_CTX_free(bn_ctx); + bn_ctx = NULL; EC_POINT_free(srvr_ecpoint); srvr_ecpoint = NULL; } -- 2.25.1