From 9529419d943c9c4cedd2397f78902c53b3091be1 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Mon, 31 Oct 2016 12:48:37 +0000 Subject: [PATCH] Fix a memory leak in the ClientHello extension parsing We should be freeing up the raw extension data after we've finished with it. Reviewed-by: Kurt Roeckx Reviewed-by: Rich Salz --- ssl/statem/statem_srvr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index c7841ac48e..ca7f5afe4b 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -907,6 +907,8 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt) * structure. */ + memset(&clienthello, 0, sizeof(clienthello)); + clienthello.isv2 = RECORD_LAYER_is_sslv2_record(&s->rlayer); PACKET_null_init(&cookie); @@ -1423,6 +1425,7 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt) } sk_SSL_CIPHER_free(ciphers); + OPENSSL_free(clienthello.pre_proc_exts); return MSG_PROCESS_CONTINUE_PROCESSING; f_err: ssl3_send_alert(s, SSL3_AL_FATAL, al); @@ -1430,6 +1433,7 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt) ossl_statem_set_error(s); sk_SSL_CIPHER_free(ciphers); + OPENSSL_free(clienthello.pre_proc_exts); return MSG_PROCESS_ERROR; } -- 2.34.1