Fix use after free.

benlaurie · benlaurie · commit 94d1f4b0f3d2 · 2014-04-23T07:24:03.000+01:00
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
@@ -1334,7 +1334,7 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
 				{
 				s->rstate=SSL_ST_READ_HEADER;
 				rr->off=0;
-				if (s->mode & SSL_MODE_RELEASE_BUFFERS)
+				if (s->mode & SSL_MODE_RELEASE_BUFFERS && s->s3->rbuf.left == 0)
 					ssl3_release_read_buffer(s);
 				}
 			}

Original file line number	Diff line number	Diff line change
`@@ -1334,7 +1334,7 @@ int ssl3_read_bytes(SSL s, int type, unsigned char buf, int len, int peek)`
`1334`	`1334`	`{`
`1335`	`1335`	`s->rstate=SSL_ST_READ_HEADER;`
`1336`	`1336`	`rr->off=0;`
`1337`		`- if (s->mode & SSL_MODE_RELEASE_BUFFERS)`
	`1337`	`+ if (s->mode & SSL_MODE_RELEASE_BUFFERS && s->s3->rbuf.left == 0)`
`1338`	`1338`	`ssl3_release_read_buffer(s);`
`1339`	`1339`	`}`
`1340`	`1340`	`}`