Ensure we free TLS 1.3 handshake state.

There is no guarantee that ssl3_clear() is called before ssl3_free(), so
free things here. Also move the chunk in ssl3_clear() up so that it is with
the "free" code rather than the "reinit" code.

ok beck@ tb@

1 files changed, 11 insertions, 6 deletions

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 0761c5b5ce..9e4998cb42 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.177 2019/01/18 12:09:52 beck Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.178 2019/01/21 01:20:11 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1565,6 +1565,11 @@ ssl3_free(SSL *s)
 
         freezero(S3I(s)->tmp.x25519, X25519_KEY_LENGTH);
 
+        tls13_secrets_destroy(S3I(s)->hs_tls13.secrets);
+        freezero(S3I(s)->hs_tls13.x25519_private, X25519_KEY_LENGTH);
+        freezero(S3I(s)->hs_tls13.x25519_public, X25519_KEY_LENGTH);
+        freezero(S3I(s)->hs_tls13.x25519_peer_public, X25519_KEY_LENGTH);
+
         sk_X509_NAME_pop_free(S3I(s)->tmp.ca_names, X509_NAME_free);
 
         tls1_transcript_free(s);
@@ -1596,6 +1601,11 @@ ssl3_clear(SSL *s)
         freezero(S3I(s)->tmp.x25519, X25519_KEY_LENGTH);
         S3I(s)->tmp.x25519 = NULL;
 
+        tls13_secrets_destroy(S3I(s)->hs_tls13.secrets);
+        freezero(S3I(s)->hs_tls13.x25519_private, X25519_KEY_LENGTH);
+        freezero(S3I(s)->hs_tls13.x25519_public, X25519_KEY_LENGTH);
+        freezero(S3I(s)->hs_tls13.x25519_peer_public, X25519_KEY_LENGTH);
+
         rp = S3I(s)->rbuf.buf;
         wp = S3I(s)->wbuf.buf;
         rlen = S3I(s)->rbuf.len;
@@ -1627,11 +1637,6 @@ ssl3_clear(SSL *s)
 
         s->internal->packet_length = 0;
         s->version = TLS1_VERSION;
-
-        tls13_secrets_destroy(S3I(s)->hs_tls13.secrets);
-        freezero(S3I(s)->hs_tls13.x25519_private, X25519_KEY_LENGTH);
-        freezero(S3I(s)->hs_tls13.x25519_public, X25519_KEY_LENGTH);
-        freezero(S3I(s)->hs_tls13.x25519_peer_public, X25519_KEY_LENGTH);
 }
 
 static long