RT3774: double-free in DSA

[openssl.git] / ssl / record / rec_layer_d1.c

diff --git a/ssl/record/rec_layer_d1.c b/ssl/record/rec_layer_d1.c
index a78f150c34fa2efc2e811b7cabefb8f66936c58a..52ef8f0834287e7f6a6c22cc4843e9221ff37c73 100644 (file)
--- a/ssl/record/rec_layer_d1.c
+++ b/ssl/record/rec_layer_d1.c
@@ -127,9 +127,8 @@ int DTLS_RECORD_LAYER_new(RECORD_LAYER *rl)
 {
     DTLS_RECORD_LAYER *d;
     
-    if ((d = OPENSSL_malloc(sizeof *d)) == NULL) {
+    if ((d = OPENSSL_malloc(sizeof(*d))) == NULL)
         return (0);
-    }
 
 
     rl->d = d;
@@ -140,12 +139,9 @@ int DTLS_RECORD_LAYER_new(RECORD_LAYER *rl)
 
     if (!d->unprocessed_rcds.q || !d->processed_rcds.q
         || !d->buffered_app_data.q) {
-        if (d->unprocessed_rcds.q)
-            pqueue_free(d->unprocessed_rcds.q);
-        if (d->processed_rcds.q)
-            pqueue_free(d->processed_rcds.q);
-        if (d->buffered_app_data.q)
-            pqueue_free(d->buffered_app_data.q);
+        pqueue_free(d->unprocessed_rcds.q);
+        pqueue_free(d->processed_rcds.q);
+        pqueue_free(d->buffered_app_data.q);
         OPENSSL_free(d);
         rl->d = NULL;
         return (0);
@@ -199,7 +195,7 @@ void DTLS_RECORD_LAYER_clear(RECORD_LAYER *rl)
     unprocessed_rcds = d->unprocessed_rcds.q;
     processed_rcds = d->processed_rcds.q;
     buffered_app_data = d->buffered_app_data.q;
-    memset(d, 0, sizeof *d);
+    memset(d, 0, sizeof(*d));
     d->unprocessed_rcds.q = unprocessed_rcds;
     d->processed_rcds.q = processed_rcds;
     d->buffered_app_data.q = buffered_app_data;
@@ -262,13 +258,11 @@ int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
     if (pqueue_size(queue->q) >= 100)
         return 0;
 
-    rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
+    rdata = OPENSSL_malloc(sizeof(*rdata));
     item = pitem_new(priority, rdata);
     if (rdata == NULL || item == NULL) {
         OPENSSL_free(rdata);
-        if (item != NULL)
-            pitem_free(item);
-
+        pitem_free(item);
         SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
         return -1;
     }
@@ -292,8 +286,8 @@ int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
 
     s->rlayer.packet = NULL;
     s->rlayer.packet_length = 0;
-    memset(&s->rlayer.rbuf, 0, sizeof(SSL3_BUFFER));
-    memset(&s->rlayer.rrec, 0, sizeof(SSL3_RECORD));
+    memset(&s->rlayer.rbuf, 0, sizeof(s->rlayer.rbuf));
+    memset(&s->rlayer.rrec, 0, sizeof(s->rlayer.rrec));
 
     if (!ssl3_setup_buffers(s)) {
         SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
@@ -710,7 +704,7 @@ int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
             (s->rlayer.d->handshake_fragment[3] != 0)) {
             al = SSL_AD_DECODE_ERROR;
             SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_BAD_HELLO_REQUEST);
-            goto err;
+            goto f_err;
         }
 
         /*
@@ -863,11 +857,8 @@ int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
     }
 
     if (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC) {
-        struct ccs_header_st ccs_hdr;
         unsigned int ccs_hdr_len = DTLS1_CCS_HEADER_LENGTH;
 
-        dtls1_get_ccs_header(SSL3_RECORD_get_data(rr), &ccs_hdr);
-
         if (s->version == DTLS1_BAD_VER)
             ccs_hdr_len = 3;
 
@@ -1304,9 +1295,10 @@ void dtls1_reset_seq_numbers(SSL *s, int rw)
     if (rw & SSL3_CC_READ) {
         seq = s->rlayer.read_sequence;
         s->rlayer.d->r_epoch++;
-        memcpy(&(s->rlayer.d->bitmap), &(s->rlayer.d->next_bitmap),
-            sizeof(DTLS1_BITMAP));
-        memset(&(s->rlayer.d->next_bitmap), 0x00, sizeof(DTLS1_BITMAP));
+        memcpy(&s->rlayer.d->bitmap, &s->rlayer.d->next_bitmap,
+               sizeof(s->rlayer.d->bitmap));
+        memset(&s->rlayer.d->next_bitmap, 0,
+               sizeof(s->rlayer.d->next_bitmap));
     } else {
         seq = s->rlayer.write_sequence;
         memcpy(s->rlayer.d->last_write_sequence, seq,
@@ -1314,5 +1306,5 @@ void dtls1_reset_seq_numbers(SSL *s, int rw)
         s->rlayer.d->w_epoch++;
     }
 
-    memset(seq, 0x00, seq_bytes);
+    memset(seq, 0, seq_bytes);
 }