Fix memory leak where fdlookup linked list is not freed during

ASYNC_WAIT_CTX_free

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

diff --git a/crypto/async/async_wait.c b/crypto/async/async_wait.c
index 94f1a6b4e03def76d8896aa240465243f24e9f76..ece995f4e9a8f356ba2e89337e34a1269e59c170 100644 (file)
--- a/crypto/async/async_wait.c
+++ b/crypto/async/async_wait.c
@@ -63,20 +63,22 @@ ASYNC_WAIT_CTX *ASYNC_WAIT_CTX_new(void)
 void ASYNC_WAIT_CTX_free(ASYNC_WAIT_CTX *ctx)
 {
     struct fd_lookup_st *curr;
+    struct fd_lookup_st *next;
 
     if (ctx == NULL)
         return;
 
     curr = ctx->fds;
     while (curr != NULL) {
-        if (curr->del) {
-            /* This one has already been deleted so do nothing */
-            curr = curr->next;
-            continue;
+        if (!curr->del) {
+            /* Only try and cleanup if it hasn't been marked deleted */
+            if (curr->cleanup != NULL)
+                curr->cleanup(ctx, curr->key, curr->fd, curr->custom_data);
         }
-        if (curr->cleanup != NULL)
-            curr->cleanup(ctx, curr->key, curr->fd, curr->custom_data);
-        curr = curr->next;
+        /* Always free the fd_lookup_st */
+        next = curr->next;
+        OPENSSL_free(curr);
+        curr = next;
     }
 
     OPENSSL_free(ctx);