tree d7876c0fd5b90532588b99ff1cfd518562513541
parent d660b57208e433d7d64973d52c3ea06a77ec4b57
author Doug Hogan <doug@acyclic.org> 1422848769 -0800
committer Adam Langley <agl@google.com> 1422925292 -0800

Move free from cbb_init() to only CBB_init().

CBB_init_fixed() should not call free because it can lead to use after
free or double free bugs.  The caller should be responsible for
creating and destroying the buffer.

In the current code, ssl3_get_v2_client_hello() may free s->init_buf->data
via CBB_init_fixed().  It can also be freed via SSL_free(s) since
ssl3_get_v2_client_hello() doesn't set it to NULL and CBB_init_fixed()
can't set the caller's pointer to NULL.

Change-Id: Ia05a67ae25af7eb4fb04f08f20d50d912b41e38b