commit 8fc2dc07d868efafe0f4db5a5df238e2576deb13
author David Benjamin <davidben@google.com> Tue Aug 22 15:07:51 2017 -0700
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Wed Aug 23 15:58:52 2017 +0000
tree 3a412d0b87b78349d79deec6bec9c482c3bcc88d
parent e7848220a241e5bbb6b98a6f1f65e4d4f1cef308

Put SCTs and OCSP responses in CRYPTO_BUFFERs.

They both can be moderately large. This should hopefully relieve a little
memory pressure from both connections to hosts which serve SCTs and
TLS 1.3's single-use tickets.

Change-Id: I034bbf057fe5a064015a0f554b3ae9ea7797cd4e
Reviewed-on: https://boringssl-review.googlesource.com/19584
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>

ssl/t1_lib.cc

diff --git a/ssl/t1_lib.cc b/ssl/t1_lib.cc
index bbe6401..e50710a 100644
--- a/ssl/t1_lib.cc
+++ b/ssl/t1_lib.cc
@@ -1327,11 +1327,14 @@
    * requirement, so tolerate this.
    *
    * TODO(davidben): Enforce this anyway. */
-  if (!ssl->s3->session_reused &&
-      !CBS_stow(contents, &hs->new_session->tlsext_signed_cert_timestamp_list,
-                &hs->new_session->tlsext_signed_cert_timestamp_list_length)) {
-    *out_alert = SSL_AD_INTERNAL_ERROR;
-    return 0;
+  if (!ssl->s3->session_reused) {
+    CRYPTO_BUFFER_free(hs->new_session->signed_cert_timestamp_list);
+    hs->new_session->signed_cert_timestamp_list =
+        CRYPTO_BUFFER_new_from_CBS(contents, ssl->ctx->pool);
+    if (hs->new_session->signed_cert_timestamp_list == nullptr) {
+      *out_alert = SSL_AD_INTERNAL_ERROR;
+      return 0;
+    }
   }
 
   return 1;