1 files changed, 30 insertions, 17 deletions

diff --git a/ssl/record/ssl3_buffer.c b/ssl/record/ssl3_buffer.c
index 3c03499f59..576533c31e 100644
--- a/ssl/record/ssl3_buffer.c
+++ b/ssl/record/ssl3_buffer.c
@@ -176,13 +176,15 @@ int ssl3_setup_read_buffer(SSL *s)
     return 0;
 }
 
-int ssl3_setup_write_buffer(SSL *s)
+int ssl3_setup_write_buffer(SSL *s, unsigned int numwpipes)
 {
     unsigned char *p;
     size_t len, align = 0, headerlen;
     SSL3_BUFFER *wb;
+    unsigned int currpipe;
+
+    s->rlayer.numwpipes = numwpipes;
 
-    wb = RECORD_LAYER_get_wbuf(&s->rlayer);
 
     if (SSL_IS_DTLS(s))
         headerlen = DTLS1_RT_HEADER_LENGTH + 1;
@@ -193,20 +195,25 @@ int ssl3_setup_write_buffer(SSL *s)
     align = (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1);
 #endif
 
-    if (wb->buf == NULL) {
-        len = s->max_send_fragment
-            + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
+    len = s->max_send_fragment
+        + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
 #ifndef OPENSSL_NO_COMP
-        if (ssl_allow_compression(s))
-            len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
+    if (ssl_allow_compression(s))
+        len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
 #endif
-        if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
-            len += headerlen + align + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
+    if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+        len += headerlen + align + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
 
-        if ((p = OPENSSL_malloc(len)) == NULL)
-            goto err;
-        wb->buf = p;
-        wb->len = len;
+    wb = RECORD_LAYER_get_wbuf(&s->rlayer);
+    for (currpipe = 0; currpipe < numwpipes; currpipe++) {
+        if (wb[currpipe].buf == NULL) {
+            if ((p = OPENSSL_malloc(len)) == NULL) {
+                s->rlayer.numwpipes = currpipe;
+                goto err;
+            }
+            wb[currpipe].buf = p;
+            wb[currpipe].len = len;
+        }
     }
 
     return 1;
@@ -220,7 +227,7 @@ int ssl3_setup_buffers(SSL *s)
 {
     if (!ssl3_setup_read_buffer(s))
         return 0;
-    if (!ssl3_setup_write_buffer(s))
+    if (!ssl3_setup_write_buffer(s, 1))
         return 0;
     return 1;
 }
@@ -228,11 +235,17 @@ int ssl3_setup_buffers(SSL *s)
 int ssl3_release_write_buffer(SSL *s)
 {
     SSL3_BUFFER *wb;
+    unsigned int pipes;
 
-    wb = RECORD_LAYER_get_wbuf(&s->rlayer);
+    pipes = s->rlayer.numwpipes;
+    while (pipes > 0) {
+        wb = &RECORD_LAYER_get_wbuf(&s->rlayer)[pipes - 1];
 
-    OPENSSL_free(wb->buf);
-    wb->buf = NULL;
+        OPENSSL_free(wb->buf);
+        wb->buf = NULL;
+        pipes--;
+    }
+    s->rlayer.numwpipes = 0;
     return 1;
 }