From 48ff651eccf2f43ddbc221a0f9ddac57169aa255 Mon Sep 17 00:00:00 2001 From: Pauli Date: Mon, 14 Sep 2020 07:36:02 +1000 Subject: DTLS: free allocated memory on error paths Reviewed-by: Richard Levitte Reviewed-by: Kurt Roeckx (Merged from https://github.com/openssl/openssl/pull/12870) --- ssl/statem/statem_dtls.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'ssl/statem') diff --git a/ssl/statem/statem_dtls.c b/ssl/statem/statem_dtls.c index 564829c808..84ae35b655 100644 --- a/ssl/statem/statem_dtls.c +++ b/ssl/statem/statem_dtls.c @@ -1051,12 +1051,16 @@ int dtls1_buffer_message(SSL *s, int is_ccs) if (!ossl_assert(s->d1->w_msg_hdr.msg_len + ((s->version == DTLS1_BAD_VER) ? 3 : DTLS1_CCS_HEADER_LENGTH) - == (unsigned int)s->init_num)) + == (unsigned int)s->init_num)) { + dtls1_hm_fragment_free(frag); return 0; + } } else { if (!ossl_assert(s->d1->w_msg_hdr.msg_len + - DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num)) + DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num)) { + dtls1_hm_fragment_free(frag); return 0; + } } frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len; -- cgit v1.2.3