Fixed out-of-bounds read errors in ssl3_get_key_exchange.

[openssl.git] / ssl / ssl_cert.c

diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 4e75a962839eb5f87d16db7a84bf1e1d8d4703e0..45049587b9ab035b1e2c4a7c6362b9e9766f1811 100644 (file)
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -423,6 +423,27 @@ CERT *ssl_cert_dup(CERT *cert)
        ret->sec_level = cert->sec_level;
        ret->sec_ex = cert->sec_ex;
 
+#ifndef OPENSSL_NO_TLSEXT
+       if (cert->custom_cli_ext_records_count)
+               {
+               ret->custom_cli_ext_records = BUF_memdup(cert->custom_cli_ext_records, sizeof(custom_cli_ext_record) * cert->custom_cli_ext_records_count);
+               if (ret->custom_cli_ext_records == NULL)
+                       goto err;
+               ret->custom_cli_ext_records_count =
+                                       cert->custom_cli_ext_records_count;
+               }
+
+       if (cert->custom_srv_ext_records_count)
+               {
+               ret->custom_srv_ext_records = BUF_memdup(cert->custom_srv_ext_records, sizeof(custom_srv_ext_record) * cert->custom_srv_ext_records_count);
+               if (ret->custom_srv_ext_records == NULL)
+                       goto err;
+               ret->custom_srv_ext_records_count =
+                                       cert->custom_srv_ext_records_count;
+               }
+
+#endif
+
        return(ret);
        
 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
@@ -441,6 +462,13 @@ err:
                EC_KEY_free(ret->ecdh_tmp);
 #endif
 
+#ifndef OPENSSL_NO_TLSEXT
+       if (ret->custom_cli_ext_records)
+               OPENSSL_free(ret->custom_cli_ext_records);
+       if (ret->custom_srv_ext_records)
+               OPENSSL_free(ret->custom_srv_ext_records);
+#endif
+
        ssl_cert_clear_certs(ret);
 
        return NULL;
@@ -531,6 +559,12 @@ void ssl_cert_free(CERT *c)
                X509_STORE_free(c->chain_store);
        if (c->ciphers_raw)
                OPENSSL_free(c->ciphers_raw);
+#ifndef OPENSSL_NO_TLSEXT
+       if (c->custom_cli_ext_records)
+               OPENSSL_free(c->custom_cli_ext_records);
+       if (c->custom_srv_ext_records)
+               OPENSSL_free(c->custom_srv_ext_records);
+#endif
        OPENSSL_free(c);
        }