9fc5ccb
diff -up openssl-1.0.1e/crypto/asn1/tasn_dec.c.item-reuse openssl-1.0.1e/crypto/asn1/tasn_dec.c
9fc5ccb
--- openssl-1.0.1e/crypto/asn1/tasn_dec.c.item-reuse	2013-02-11 16:26:04.000000000 +0100
9fc5ccb
+++ openssl-1.0.1e/crypto/asn1/tasn_dec.c	2015-03-19 15:46:51.097022616 +0100
9fc5ccb
@@ -310,9 +310,19 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval,
9fc5ccb
 		case ASN1_ITYPE_CHOICE:
9fc5ccb
 		if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
9fc5ccb
 				goto auxerr;
9fc5ccb
-
9fc5ccb
-		/* Allocate structure */
9fc5ccb
-		if (!*pval && !ASN1_item_ex_new(pval, it))
9fc5ccb
+		if (*pval)
9fc5ccb
+			{
9fc5ccb
+			/* Free up and zero CHOICE value if initialised */
9fc5ccb
+			i = asn1_get_choice_selector(pval, it);
9fc5ccb
+			if ((i >= 0) && (i < it->tcount))
9fc5ccb
+				{
9fc5ccb
+				tt = it->templates + i;
9fc5ccb
+				pchptr = asn1_get_field_ptr(pval, tt);
9fc5ccb
+				ASN1_template_free(pchptr, tt);
9fc5ccb
+				asn1_set_choice_selector(pval, -1, it);
9fc5ccb
+				}
9fc5ccb
+			}
9fc5ccb
+		else if (!ASN1_item_ex_new(pval, it))
9fc5ccb
 			{
9fc5ccb
 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
9fc5ccb
 						ERR_R_NESTED_ASN1_ERROR);
9fc5ccb
@@ -407,6 +417,19 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval,
9fc5ccb
 		if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
9fc5ccb
 				goto auxerr;
9fc5ccb
 
9fc5ccb
+		/* Free up and zero any ADB found */
9fc5ccb
+		for (i = 0, tt = it->templates; i < it->tcount; i++, tt++)
9fc5ccb
+			{
9fc5ccb
+			if (tt->flags & ASN1_TFLG_ADB_MASK)
9fc5ccb
+				{
9fc5ccb
+				const ASN1_TEMPLATE *seqtt;
9fc5ccb
+				ASN1_VALUE **pseqval;
9fc5ccb
+				seqtt = asn1_do_adb(pval, tt, 1);
9fc5ccb
+				pseqval = asn1_get_field_ptr(pval, seqtt);
9fc5ccb
+				ASN1_template_free(pseqval, seqtt);
9fc5ccb
+				}
9fc5ccb
+			}
9fc5ccb
+
9fc5ccb
 		/* Get each field entry */
9fc5ccb
 		for (i = 0, tt = it->templates; i < it->tcount; i++, tt++)
9fc5ccb
 			{