|
 |
1b2890 |
From 2172d4f63c61922487008f42511cc6bdae9b47a0 Mon Sep 17 00:00:00 2001
|
|
|
1b2890 |
From: Adam Langley <agl@imperialviolet.org>
|
|
|
1b2890 |
Date: Fri, 6 Jun 2014 14:19:21 -0700
|
|
|
1b2890 |
Subject: [PATCH] Avoid double free when processing DTLS packets.
|
|
|
1b2890 |
MIME-Version: 1.0
|
|
|
1b2890 |
Content-Type: text/plain; charset=UTF-8
|
|
|
1b2890 |
Content-Transfer-Encoding: 8bit
|
|
|
1b2890 |
|
|
|
1b2890 |
The |item| variable, in both of these cases, may contain a pointer to a
|
|
|
1b2890 |
|pitem| structure within |s->d1->buffered_messages|. It was being freed
|
|
|
1b2890 |
in the error case while still being in |buffered_messages|. When the
|
|
|
1b2890 |
error later caused the |SSL*| to be destroyed, the item would be double
|
|
|
1b2890 |
freed.
|
|
|
1b2890 |
|
|
|
1b2890 |
Thanks to Wah-Teh Chang for spotting that the fix in 1632ef74 was
|
|
|
1b2890 |
inconsistent with the other error paths (but correct).
|
|
|
1b2890 |
|
|
|
1b2890 |
Fixes CVE-2014-3505
|
|
|
1b2890 |
|
|
|
1b2890 |
Reviewed-by: Matt Caswell <matt@openssl.org>
|
|
|
1b2890 |
Reviewed-by: Emilia Käsper <emilia@openssl.org>
|
|
|
1b2890 |
---
|
|
|
1b2890 |
ssl/d1_both.c | 6 ++----
|
|
|
1b2890 |
1 file changed, 2 insertions(+), 4 deletions(-)
|
|
|
1b2890 |
|
|
|
1b2890 |
diff --git a/ssl/d1_both.c b/ssl/d1_both.c
|
|
|
1b2890 |
index c1eb970..cdb83b6 100644
|
|
|
1b2890 |
--- a/ssl/d1_both.c
|
|
|
1b2890 |
+++ b/ssl/d1_both.c
|
|
|
1b2890 |
@@ -693,8 +693,7 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
|
|
|
1b2890 |
return DTLS1_HM_FRAGMENT_RETRY;
|
|
|
1b2890 |
|
|
|
1b2890 |
err:
|
|
|
1b2890 |
- if (frag != NULL) dtls1_hm_fragment_free(frag);
|
|
|
1b2890 |
- if (item != NULL) OPENSSL_free(item);
|
|
|
1b2890 |
+ if (frag != NULL && item == NULL) dtls1_hm_fragment_free(frag);
|
|
|
1b2890 |
*ok = 0;
|
|
|
1b2890 |
return i;
|
|
|
1b2890 |
}
|
|
|
1b2890 |
@@ -778,8 +777,7 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
|
|
|
1b2890 |
return DTLS1_HM_FRAGMENT_RETRY;
|
|
|
1b2890 |
|
|
|
1b2890 |
err:
|
|
|
1b2890 |
- if ( frag != NULL) dtls1_hm_fragment_free(frag);
|
|
|
1b2890 |
- if ( item != NULL) OPENSSL_free(item);
|
|
|
1b2890 |
+ if (frag != NULL && item == NULL) dtls1_hm_fragment_free(frag);
|
|
|
1b2890 |
*ok = 0;
|
|
|
1b2890 |
return i;
|
|
|
1b2890 |
}
|
|
|
1b2890 |
--
|
|
|
1b2890 |
1.8.3.1
|
|
|
1b2890 |
|