Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after...
authorDavid Ramos <daramos@stanford.edu>
Sun, 1 Jun 2014 20:42:47 +0000 (21:42 +0100)
committerMatt Caswell <matt@openssl.org>
Sun, 1 Jun 2014 20:42:47 +0000 (21:42 +0100)
ssl/d1_pkt.c

index cbefaecf8f5267188f13724e5a1a2e63f9a9e1f6..5d0075cca8c94f934a7b1a60a06b7a9019055e34 100644 (file)
@@ -231,13 +231,6 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
 
        item->data = rdata;
 
-       /* insert should not fail, since duplicates are dropped */
-       if (pqueue_insert(queue->q, item) == NULL)
-               {
-               OPENSSL_free(rdata);
-               pitem_free(item);
-               return(0);
-               }
 
        s->packet = NULL;
        s->packet_length = 0;
@@ -251,6 +244,14 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
                pitem_free(item);
                return(0);
                }
+
+       /* insert should not fail, since duplicates are dropped */
+       if (pqueue_insert(queue->q, item) == NULL)
+               {
+               OPENSSL_free(rdata);
+               pitem_free(item);
+               return(0);
+               }
        
        return(1);
        }