A memory leak can occur in dtls1_buffer_record if either of the calls to

[openssl.git] / ssl / d1_pkt.c

diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index de184e33a329401c51910f721e0e239e9a8f2f44..003d6207594aae0b8973fd2a0ba18d2940bb81f6 100644 (file)
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -212,7 +212,7 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
        /* Limit the size of the queue to prevent DOS attacks */
        if (pqueue_size(queue->q) >= 100)
                return 0;
-               
+
        rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
        item = pitem_new(priority, rdata);
        if (rdata == NULL || item == NULL)
@@ -239,18 +239,22 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
        if (!ssl3_setup_buffers(s))
                {
                SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
+               if (rdata->rbuf.buf != NULL)
+                       OPENSSL_free(rdata->rbuf.buf);
                OPENSSL_free(rdata);
                pitem_free(item);
-               return(0);
+               return(-1);
                }
 
        /* insert should not fail, since duplicates are dropped */
        if (pqueue_insert(queue->q, item) == NULL)
                {
                SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
+               if (rdata->rbuf.buf != NULL)
+                       OPENSSL_free(rdata->rbuf.buf);
                OPENSSL_free(rdata);
                pitem_free(item);
-               return(0);
+               return(-1);
                }
        
        return(1);
@@ -306,8 +310,9 @@ dtls1_process_buffered_records(SSL *s)
             dtls1_get_unprocessed_record(s);
             if ( ! dtls1_process_record(s))
                 return(0);
-            dtls1_buffer_record(s, &(s->d1->processed_rcds), 
-                s->s3->rrec.seq_num);
+            if(dtls1_buffer_record(s, &(s->d1->processed_rcds),
+                s->s3->rrec.seq_num)<0)
+                return -1;
             }
         }
 
@@ -522,7 +527,6 @@ printf("\n");
 
        /* we have pulled in a full packet so zero things */
        s->packet_length=0;
-       dtls1_record_bitmap_update(s, &(s->d1->bitmap));/* Mark receipt of record. */
        return(1);
 
 f_err:
@@ -555,7 +559,8 @@ int dtls1_get_record(SSL *s)
 
        /* The epoch may have changed.  If so, process all the
         * pending records.  This is a non-blocking operation. */
-       dtls1_process_buffered_records(s);
+       if(dtls1_process_buffered_records(s)<0)
+               return -1;
 
        /* if we're renegotiating, then there may be buffered records */
        if (dtls1_get_processed_record(s))
@@ -684,7 +689,9 @@ again:
                {
                if ((SSL_in_init(s) || s->in_handshake) && !s->d1->listen)
                        {
-                       dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num);
+                       if(dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num)<0)
+                               return -1;
+                       dtls1_record_bitmap_update(s, bitmap);/* Mark receipt of record. */
                        }
                rr->length = 0;
                s->packet_length = 0;
@@ -697,6 +704,7 @@ again:
                s->packet_length = 0;  /* dump this record */
                goto again;   /* get another record */
                }
+       dtls1_record_bitmap_update(s, bitmap);/* Mark receipt of record. */
 
        return(1);
 
@@ -829,7 +837,11 @@ start:
                 * buffer the application data for later processing rather
                 * than dropping the connection.
                 */
-               dtls1_buffer_record(s, &(s->d1->buffered_app_data), rr->seq_num);
+               if(dtls1_buffer_record(s, &(s->d1->buffered_app_data), rr->seq_num)<0)
+                       {
+                       SSLerr(SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR);
+                       return -1;
+                       }
                rr->length = 0;
                goto start;
                }