tree 2de8347e84826af4987f79f6b8831778cbbee54e
parent 35c8afd3143289c99aa3820e01950c564d7aced8
author David Benjamin <davidben@google.com> 1477354400 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1477426545 +0000

Check SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER before touching wpend_buf.

SSL_write has messy semantics around retries. As a sanity-check, it does
pointer and length checks and requires the original and retry SSL_write
pass the same buffer pointer.

In some cases, buffer addresses may change but still include the
original data as a prefix on the retry. Callers then set
SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER to skip the pointer check. But, in
that case, the pointer may have been freed so doing a comparison is
undefined behavior.

Short-circuiting the pointer equality check avoids this problem.

Change-Id: I76cb8f7d45533504cd95287bc53897ca636af51d
Reviewed-on: https://boringssl-review.googlesource.com/11760
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>