From d31b25138f26cad65182a325561f929d67806248 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 15 Mar 2016 11:38:56 +0000 Subject: [PATCH 1/1] Ensure that memory allocated for the ticket is freed If a call to EVP_DecryptUpdate fails then a memory leak could occur. Ensure that the memory is freed appropriately. Issue reported by Guido Vranken. Reviewed-by: Richard Levitte --- ssl/t1_lib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 2e9b65b3fd..090f93ef62 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -2321,8 +2321,10 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx); eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx); sdec = OPENSSL_malloc(eticklen); - if (!sdec || EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen) <= 0) { + if (sdec == NULL + || EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen) <= 0) { EVP_CIPHER_CTX_cleanup(&ctx); + OPENSSL_free(sdec); return -1; } if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0) { -- 2.34.1