From ce1e801013a739747693f675f03c3c067bd8abd2 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Lutz=20J=C3=A4nicke?= Date: Tue, 26 Feb 2002 21:50:28 +0000 Subject: [PATCH] Make sure to remove bad sessions in SSL_clear() (found by Yoram Zahavi). --- CHANGES | 4 ++++ ssl/ssl_lib.c | 14 ++++++-------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/CHANGES b/CHANGES index 634d12a725..e850b502e2 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,10 @@ Changes between 0.9.6c and 0.9.6d [XX xxx XXXX] + *) Fix bug in SSL_clear(): bad sessions were not removed (found by + Yoram Zahavi ). + [Lutz Jaenicke] + *) Add information about CygWin 1.3 and on, and preserve proper configuration for the versions before that. [Corinna Vinschen and Richard Levitte] diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 24cec2afe5..4a32d3d659 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -85,7 +85,6 @@ OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={ int SSL_clear(SSL *s) { - int state; if (s->method == NULL) { @@ -110,9 +109,14 @@ int SSL_clear(SSL *s) } #endif - state=s->state; /* Keep to check if we throw away the session-id */ s->type=0; + if (ssl_clear_bad_session(s)) + { + SSL_SESSION_free(s->session); + s->session=NULL; + } + s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT); s->version=s->method->version; @@ -131,12 +135,6 @@ int SSL_clear(SSL *s) ssl_clear_cipher_ctx(s); - if (ssl_clear_bad_session(s)) - { - SSL_SESSION_free(s->session); - s->session=NULL; - } - s->first_packet=0; #if 1 -- 2.25.1