[src/trunk]: src/crypto/external/bsd/openssl/dist/ssl Fix use after free:

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4b65efc96f9c
branches:  trunk
changeset: 328682:4b65efc96f9c
user:      christos <christos%NetBSD.org@localhost>
date:      Sun Apr 13 13:14:15 2014 +0000

description:
Fix use after free:
https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest
https://rt.openssl.org/Ticket/Display.html?id=3265&user=guest&pass=guest

diffstat:

 crypto/external/bsd/openssl/dist/ssl/s3_pkt.c |  3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diffs (13 lines):

diff -r d31aa1bedfce -r 4b65efc96f9c crypto/external/bsd/openssl/dist/ssl/s3_pkt.c
--- a/crypto/external/bsd/openssl/dist/ssl/s3_pkt.c     Sun Apr 13 12:42:47 2014 +0000
+++ b/crypto/external/bsd/openssl/dist/ssl/s3_pkt.c     Sun Apr 13 13:14:15 2014 +0000
@@ -1057,7 +1057,8 @@
                                s->rstate=SSL_ST_READ_HEADER;
                                rr->off=0;
                                if (s->mode & SSL_MODE_RELEASE_BUFFERS)
-                                       ssl3_release_read_buffer(s);
+                                       if (s->s3->rbuf.left == 0) /* no read-ahead left? */
+                                               ssl3_release_read_buffer(s);
                                }
                        }
                return(n);