Release read and write buffers using freezero().

Provide a ssl3_release_buffer() function that correctly frees a buffer
and call it from the appropriate locations. While here also change
ssl3_release_{read,write}_buffer() to void since they cannot fail and
no callers check the return value currently.

ok beck@ inoguchi@ tb@

4 files changed, 26 insertions, 21 deletions

diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index 1f818307d1..758f5195e6 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_lib.c,v 1.46 2020/07/07 19:31:11 jsing Exp $ */
+/* $OpenBSD: d1_lib.c,v 1.47 2020/09/24 17:59:54 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -132,14 +132,14 @@ dtls1_clear_queues(SSL *s)
 
         while ((item = pqueue_pop(D1I(s)->unprocessed_rcds.q)) != NULL) {
                 rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data;
-                free(rdata->rbuf.buf);
+                ssl3_release_buffer(&rdata->rbuf);
                 free(item->data);
                 pitem_free(item);
         }
 
         while ((item = pqueue_pop(D1I(s)->processed_rcds.q)) != NULL) {
                 rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data;
-                free(rdata->rbuf.buf);
+                ssl3_release_buffer(&rdata->rbuf);
                 free(item->data);
                 pitem_free(item);
         }
@@ -160,7 +160,7 @@ dtls1_clear_queues(SSL *s)
 
         while ((item = pqueue_pop(D1I(s)->buffered_app_data.q)) != NULL) {
                 rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data;
-                free(rdata->rbuf.buf);
+                ssl3_release_buffer(&rdata->rbuf);
                 free(item->data);
                 pitem_free(item);
         }
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 748ff988da..31ea52fcae 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_pkt.c,v 1.81 2020/08/30 15:40:19 jsing Exp $ */
+/* $OpenBSD: d1_pkt.c,v 1.82 2020/09/24 17:59:54 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -200,7 +200,7 @@ dtls1_copy_record(SSL *s, pitem *item)
 
         rdata = (DTLS1_RECORD_DATA_INTERNAL *)item->data;
 
-        free(S3I(s)->rbuf.buf);
+        ssl3_release_buffer(&S3I(s)->rbuf);
 
         s->internal->packet = rdata->packet;
         s->internal->packet_length = rdata->packet_length;
@@ -251,7 +251,7 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
         return (1);
 
 err:
-        free(rdata->rbuf.buf);
+        ssl3_release_buffer(&rdata->rbuf);
 
 init_err:
         SSLerror(s, ERR_R_INTERNAL_ERROR);
diff --git a/src/lib/libssl/ssl_both.c b/src/lib/libssl/ssl_both.c
index 488a5ff7c9..dff44ecd41 100644
--- a/src/lib/libssl/ssl_both.c
+++ b/src/lib/libssl/ssl_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_both.c,v 1.18 2020/05/19 16:35:20 jsing Exp $ */
+/* $OpenBSD: ssl_both.c,v 1.19 2020/09/24 17:59:54 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -708,7 +708,7 @@ ssl3_setup_read_buffer(SSL *s)
                 S3I(s)->rbuf.len = len;
         }
 
-        s->internal->packet = &(S3I(s)->rbuf.buf[0]);
+        s->internal->packet = S3I(s)->rbuf.buf;
         return 1;
 
 err:
@@ -759,18 +759,22 @@ ssl3_setup_buffers(SSL *s)
         return 1;
 }
 
-int
-ssl3_release_write_buffer(SSL *s)
+void
+ssl3_release_buffer(SSL3_BUFFER_INTERNAL *b)
 {
-        free(S3I(s)->wbuf.buf);
-        S3I(s)->wbuf.buf = NULL;
-        return 1;
+        freezero(b->buf, b->len);
+        b->buf = NULL;
+        b->len = 0;
 }
 
-int
+void
 ssl3_release_read_buffer(SSL *s)
 {
-        free(S3I(s)->rbuf.buf);
-        S3I(s)->rbuf.buf = NULL;
-        return 1;
+        ssl3_release_buffer(&S3I(s)->rbuf);
+}
+
+void
+ssl3_release_write_buffer(SSL *s)
+{
+        ssl3_release_buffer(&S3I(s)->wbuf);
 }
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index a3b8a80572..d4ba7f66d4 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.293 2020/09/17 15:23:29 jsing Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.294 2020/09/24 17:59:54 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1223,8 +1223,9 @@ int	ssl3_setup_buffers(SSL *s);
 int     ssl3_setup_init_buffer(SSL *s);
 int     ssl3_setup_read_buffer(SSL *s);
 int     ssl3_setup_write_buffer(SSL *s);
-int     ssl3_release_read_buffer(SSL *s);
-int     ssl3_release_write_buffer(SSL *s);
+void ssl3_release_buffer(SSL3_BUFFER_INTERNAL *b);
+void ssl3_release_read_buffer(SSL *s);
+void ssl3_release_write_buffer(SSL *s);
 int     ssl3_new(SSL *s);
 void    ssl3_free(SSL *s);
 int     ssl3_accept(SSL *s);