commit 734fca08902889c88e84839134262bdf5c12eebf
author David Benjamin <davidben@chromium.org> Tue Aug 05 13:06:20 2014 -0400
committer Adam Langley <agl@google.com> Tue Aug 05 18:07:32 2014 +0000
tree 647eacfcb19544f4eed1673811c63084d5e5b0d0
parent 95fcaa4f4b737df12f88e08e2311367d513e0d0b

Fix memory leak in ssl3_get_cert_verify.

Any ssl3_get_* function that takes ownership of something before the
ssl_get_message call can't early-return without cleanup work.

This fixes valgrind on ClientAuth-Server-Async.

Change-Id: Ie7f0b37cac4d4bb7e06c00bae091fee0386c22da
Reviewed-on: https://boringssl-review.googlesource.com/1413
Reviewed-by: Adam Langley <agl@google.com>

ssl/s3_srvr.c

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 97b04f8..7221fb0 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2530,7 +2530,7 @@
 	if (!(type & EVP_PKT_SIGN))
 		{
 		ret = 1;
-		goto end;
+		goto done_with_buffer;
 		}
 
 	n=s->method->ssl_get_message(s,
@@ -2540,7 +2540,11 @@
 		SSL3_RT_MAX_PLAIN_LENGTH,
 		&ok);
 
-	if (!ok) return((int)n);
+	if (!ok)
+		{
+		ret = (int)n;
+		goto done;
+		}
 
 	CBS_init(&certificate_verify, s->init_msg, n);
 
@@ -2650,13 +2654,15 @@
 f_err:
 		ssl3_send_alert(s,SSL3_AL_FATAL,al);
 		}
-end:
+done_with_buffer:
+	/* There is no more need for the handshake buffer. */
 	if (s->s3->handshake_buffer)
 		{
 		BIO_free(s->s3->handshake_buffer);
 		s->s3->handshake_buffer = NULL;
 		s->s3->flags &= ~TLS1_FLAGS_KEEP_HANDSHAKE;
 		}
+done:
 	EVP_MD_CTX_cleanup(&mctx);
 	EVP_PKEY_free(pkey);
 	return(ret);