diff options
| author | Dr. Matthias St. Pierre <matthias.st.pierre@ncp-e.com> | 2020-05-06 17:24:13 +0200 |
|---|---|---|
| committer | Dr. Matthias St. Pierre <matthias.st.pierre@ncp-e.com> | 2020-05-07 19:18:09 +0200 |
| commit | 73d6b4efe6835a6c97ce61df6bf339b0903e5b7a (patch) | |
| tree | 93e28297d9835a58141059231857083eb2fa3660 /ssl | |
| parent | 90fc2c26df23811be080093772b2161850385863 (diff) | |
Fix use-after-free in BIO_C_SET_SSL callback
Since the BIO_SSL structure was renewed by `ssl_free(b)/ssl_new(b)`,
the `bs` pointer needs to be updated before assigning to `bs->ssl`.
Thanks to @suishixingkong for reporting the issue and providing a fix.
Closes #10539
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11746)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/bio_ssl.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c index b44ec3e5e1..ca364fd14f 100644 --- a/ssl/bio_ssl.c +++ b/ssl/bio_ssl.c @@ -284,6 +284,7 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr) ssl_free(b); if (!ssl_new(b)) return 0; + bs = BIO_get_data(b); } BIO_set_shutdown(b, num); ssl = (SSL *)ptr; |