make RSA blinding thread-safe

[openssl.git] / ssl / s2_clnt.c

diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index 681bfad8f7813b50d5641902b2e50c4719a5c3ad..1d24dedc918b261552f0b9376079dbd124fa2c43 100644 (file)
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -208,10 +208,13 @@ int ssl2_connect(SSL *s)
                        if (!BUF_MEM_grow(buf,
                                SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER))
                                {
+                               if (buf == s->init_buf)
+                                       buf=NULL;
                                ret= -1;
                                goto end;
                                }
                        s->init_buf=buf;
+                       buf=NULL;
                        s->init_num=0;
                        s->state=SSL2_ST_SEND_CLIENT_HELLO_A;
                        s->ctx->stats.sess_connect++;
@@ -338,6 +341,8 @@ int ssl2_connect(SSL *s)
                }
 end:
        s->in_handshake--;
+       if (buf != NULL)
+               BUF_MEM_free(buf);
        if (cb != NULL) 
                cb(s,SSL_CB_CONNECT_EXIT,ret);
        return(ret);
@@ -770,8 +775,8 @@ static int client_certificate(SSL *s)
        if (s->state == SSL2_ST_SEND_CLIENT_CERTIFICATE_A)
                {
                i=ssl2_read(s,(char *)&(buf[s->init_num]),
-                       SSL2_MAX_CERT_CHALLENGE_LENGTH+1-s->init_num);
-               if (i<(SSL2_MIN_CERT_CHALLENGE_LENGTH+1-s->init_num))
+                       SSL2_MAX_CERT_CHALLENGE_LENGTH+2-s->init_num);
+               if (i<(SSL2_MIN_CERT_CHALLENGE_LENGTH+2-s->init_num))
                        return(ssl2_part_read(s,SSL_F_CLIENT_CERTIFICATE,i));
                s->init_num += i;
                if (s->msg_callback)
@@ -1009,14 +1014,14 @@ static int get_server_finished(SSL *s)
                 * or bad things can happen */
                /* ZZZZZZZZZZZZZ */
                s->session->session_id_length=SSL2_SSL_SESSION_ID_LENGTH;
-               memcpy(s->session->session_id,p,SSL2_SSL_SESSION_ID_LENGTH);
+               memcpy(s->session->session_id,p+1,SSL2_SSL_SESSION_ID_LENGTH);
                }
        else
                {
                if (!(s->options & SSL_OP_MICROSOFT_SESS_ID_BUG))
                        {
                        if ((s->session->session_id_length > sizeof s->session->session_id)
-                           || (0 != memcmp(buf, s->session->session_id,
+                           || (0 != memcmp(buf + 1, s->session->session_id,
                                            (unsigned int)s->session->session_id_length)))
                                {
                                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);