dtls1_new: free s on error path

Reviewed-by: Richard Levitte <levitte@openssl.org>

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 44c7882f3cf3e187f331585e2003720ed9c5b766..f36d570247122efdd3e5754172b05d7ab60cd830 100644 (file)
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -123,7 +123,11 @@ int dtls1_new(SSL *s)
        DTLS1_STATE *d1;
 
        if (!ssl3_new(s)) return(0);
-       if ((d1=OPENSSL_malloc(sizeof *d1)) == NULL) return (0);
+       if ((d1=OPENSSL_malloc(sizeof *d1)) == NULL)
+               {
+               ssl3_free(s);
+               return (0);
+               }
        memset(d1,0, sizeof *d1);
 
        /* d1->handshake_epoch=0; */
@@ -145,12 +149,13 @@ int dtls1_new(SSL *s)
        if( ! d1->unprocessed_rcds.q || ! d1->processed_rcds.q 
         || ! d1->buffered_messages || ! d1->sent_messages || ! d1->buffered_app_data.q)
                {
-        if ( d1->unprocessed_rcds.q) pqueue_free(d1->unprocessed_rcds.q);
-        if ( d1->processed_rcds.q) pqueue_free(d1->processed_rcds.q);
-        if ( d1->buffered_messages) pqueue_free(d1->buffered_messages);
+               if ( d1->unprocessed_rcds.q) pqueue_free(d1->unprocessed_rcds.q);
+               if ( d1->processed_rcds.q) pqueue_free(d1->processed_rcds.q);
+               if ( d1->buffered_messages) pqueue_free(d1->buffered_messages);
                if ( d1->sent_messages) pqueue_free(d1->sent_messages);
                if ( d1->buffered_app_data.q) pqueue_free(d1->buffered_app_data.q);
                OPENSSL_free(d1);
+               ssl3_free(s);
                return (0);
                }