|
 |
ffdfc30 |
diff -up openssl-1.0.1e/ssl/d1_both.c.dtls-memleak openssl-1.0.1e/ssl/d1_both.c
|
|
|
ffdfc30 |
--- openssl-1.0.1e/ssl/d1_both.c.dtls-memleak 2014-08-07 17:51:18.457493922 +0200
|
|
|
ffdfc30 |
+++ openssl-1.0.1e/ssl/d1_both.c 2014-08-07 17:58:28.478558785 +0200
|
|
|
ffdfc30 |
@@ -610,6 +610,9 @@ dtls1_reassemble_fragment(SSL *s, struct
|
|
|
ffdfc30 |
msg_hdr->msg_len > dtls1_max_handshake_message_len(s))
|
|
|
ffdfc30 |
goto err;
|
|
|
ffdfc30 |
|
|
|
ffdfc30 |
+ if (frag_len == 0)
|
|
|
ffdfc30 |
+ return DTLS1_HM_FRAGMENT_RETRY;
|
|
|
ffdfc30 |
+
|
|
|
ffdfc30 |
/* Try to find item in queue */
|
|
|
ffdfc30 |
memset(seq64be,0,sizeof(seq64be));
|
|
|
ffdfc30 |
seq64be[6] = (unsigned char) (msg_hdr->seq>>8);
|
|
|
ffdfc30 |
@@ -686,7 +689,12 @@ dtls1_reassemble_fragment(SSL *s, struct
|
|
|
ffdfc30 |
i = -1;
|
|
|
ffdfc30 |
}
|
|
|
ffdfc30 |
|
|
|
ffdfc30 |
- pqueue_insert(s->d1->buffered_messages, item);
|
|
|
ffdfc30 |
+ item = pqueue_insert(s->d1->buffered_messages, item);
|
|
|
ffdfc30 |
+ /* pqueue_insert fails iff a duplicate item is inserted.
|
|
|
ffdfc30 |
+ * However, |item| cannot be a duplicate. If it were,
|
|
|
ffdfc30 |
+ * |pqueue_find|, above, would have returned it and control
|
|
|
ffdfc30 |
+ * would never have reached this branch. */
|
|
|
ffdfc30 |
+ OPENSSL_assert(item != NULL);
|
|
|
ffdfc30 |
}
|
|
|
ffdfc30 |
|
|
|
ffdfc30 |
return DTLS1_HM_FRAGMENT_RETRY;
|
|
|
ffdfc30 |
@@ -744,7 +752,7 @@ dtls1_process_out_of_seq_message(SSL *s,
|
|
|
ffdfc30 |
}
|
|
|
ffdfc30 |
else
|
|
|
ffdfc30 |
{
|
|
|
ffdfc30 |
- if (frag_len && frag_len < msg_hdr->msg_len)
|
|
|
ffdfc30 |
+ if (frag_len < msg_hdr->msg_len)
|
|
|
ffdfc30 |
return dtls1_reassemble_fragment(s, msg_hdr, ok);
|
|
|
ffdfc30 |
|
|
|
ffdfc30 |
if (frag_len > dtls1_max_handshake_message_len(s))
|
|
|
ffdfc30 |
@@ -773,7 +781,15 @@ dtls1_process_out_of_seq_message(SSL *s,
|
|
|
ffdfc30 |
if ( item == NULL)
|
|
|
ffdfc30 |
goto err;
|
|
|
ffdfc30 |
|
|
|
ffdfc30 |
- pqueue_insert(s->d1->buffered_messages, item);
|
|
|
ffdfc30 |
+ item = pqueue_insert(s->d1->buffered_messages, item);
|
|
|
ffdfc30 |
+ /* pqueue_insert fails iff a duplicate item is inserted.
|
|
|
ffdfc30 |
+ * However, |item| cannot be a duplicate. If it were,
|
|
|
ffdfc30 |
+ * |pqueue_find|, above, would have returned it. Then, either
|
|
|
ffdfc30 |
+ * |frag_len| != |msg_hdr->msg_len| in which case |item| is set
|
|
|
ffdfc30 |
+ * to NULL and it will have been processed with
|
|
|
ffdfc30 |
+ * |dtls1_reassemble_fragment|, above, or the record will have
|
|
|
ffdfc30 |
+ * been discarded. */
|
|
|
ffdfc30 |
+ OPENSSL_assert(item != NULL);
|
|
|
ffdfc30 |
}
|
|
|
ffdfc30 |
|
|
|
ffdfc30 |
return DTLS1_HM_FRAGMENT_RETRY;
|