DVCS (see RFC 3029) was missing among the possible purposes.

[openssl.git] / ssl / s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index bc7523cdf143864f15756ff5e062f81e0d432d92..477b6816453c4c1395776741036a0ec57b465add 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -183,7 +183,7 @@ SSL_METHOD *SSLv3_client_method(void)
 
 int ssl3_connect(SSL *s)
        {
-       BUF_MEM *buf;
+       BUF_MEM *buf=NULL;
        unsigned long Time=time(NULL),l;
        long num1;
        void (*cb)(const SSL *ssl,int type,int val)=NULL;
@@ -244,6 +244,7 @@ int ssl3_connect(SSL *s)
                                        goto end;
                                        }
                                s->init_buf=buf;
+                               buf=NULL;
                                }
 
                        if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
@@ -529,6 +530,8 @@ int ssl3_connect(SSL *s)
                }
 end:
        s->in_handshake--;
+       if (buf != NULL)
+               BUF_MEM_free(buf);
        if (cb != NULL)
                cb(s,SSL_CB_CONNECT_EXIT,ret);
        return(ret);
@@ -722,6 +725,11 @@ static int ssl3_get_server_hello(SSL *s)
                goto f_err;
                }
 
+       /* Depending on the session caching (internal/external), the cipher
+          and/or cipher_id values may not be set. Make sure that
+          cipher_id is set and use it for comparison. */
+       if (s->session->cipher)
+               s->session->cipher_id = s->session->cipher->id;
        if (s->hit && (s->session->cipher_id != c->id))
                {
                if (!(s->options &
@@ -1652,7 +1660,7 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                s->method->ssl3_enc->generate_master_secret(s,
                                        s->session->master_key,
                                        tmp_buf,sizeof tmp_buf);
-                       memset(tmp_buf,0,sizeof tmp_buf);
+                       OPENSSL_cleanse(tmp_buf,sizeof tmp_buf);
                        }
 #endif
 #ifndef OPENSSL_NO_KRB5
@@ -1783,8 +1791,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                        s->session->master_key,
                                        tmp_buf, sizeof tmp_buf);
 
-                       memset(tmp_buf, 0, sizeof tmp_buf);
-                       memset(epms, 0, outl);
+                       OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
+                       OPENSSL_cleanse(epms, outl);
                         }
 #endif
 #ifndef OPENSSL_NO_DH