From e516f9888833076af8ba7f8c411514db2872aa94 Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Thu, 24 Sep 2020 17:59:54 +0000
Subject: Release read and write buffers using freezero().

Provide a ssl3_release_buffer() function that correctly frees a buffer
and call it from the appropriate locations. While here also change
ssl3_release_{read,write}_buffer() to void since they cannot fail and
no callers check the return value currently.

ok beck@ inoguchi@ tb@
---
 src/lib/libssl/d1_lib.c   |  8 ++++----
 src/lib/libssl/d1_pkt.c   |  6 +++---
 src/lib/libssl/ssl_both.c | 26 +++++++++++++++-----------
 src/lib/libssl/ssl_locl.h |  7 ++++---
 4 files changed, 26 insertions(+), 21 deletions(-)

(limited to 'src')

diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index 1f818307d1..758f5195e6 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_lib.c,v 1.46 2020/07/07 19:31:11 jsing Exp $ */
+/* $OpenBSD: d1_lib.c,v 1.47 2020/09/24 17:59:54 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -132,14 +132,14 @@ dtls1_clear_queues(SSL *s)
 
 	while ((item = pqueue_pop(D1I(s)->unprocessed_rcds.q)) != NULL) {
 		rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data;
-		free(rdata->rbuf.buf);
+		ssl3_release_buffer(&rdata->rbuf);
 		free(item->data);
 		pitem_free(item);
 	}
 
 	while ((item = pqueue_pop(D1I(s)->processed_rcds.q)) != NULL) {
 		rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data;
-		free(rdata->rbuf.buf);
+		ssl3_release_buffer(&rdata->rbuf);
 		free(item->data);
 		pitem_free(item);
 	}
@@ -160,7 +160,7 @@ dtls1_clear_queues(SSL *s)
 
 	while ((item = pqueue_pop(D1I(s)->buffered_app_data.q)) != NULL) {
 		rdata = (DTLS1_RECORD_DATA_INTERNAL *) item->data;
-		free(rdata->rbuf.buf);
+		ssl3_release_buffer(&rdata->rbuf);
 		free(item->data);
 		pitem_free(item);
 	}
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 748ff988da..31ea52fcae 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_pkt.c,v 1.81 2020/08/30 15:40:19 jsing Exp $ */
+/* $OpenBSD: d1_pkt.c,v 1.82 2020/09/24 17:59:54 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -200,7 +200,7 @@ dtls1_copy_record(SSL *s, pitem *item)
 
 	rdata = (DTLS1_RECORD_DATA_INTERNAL *)item->data;
 
-	free(S3I(s)->rbuf.buf);
+	ssl3_release_buffer(&S3I(s)->rbuf);
 
 	s->internal->packet = rdata->packet;
 	s->internal->packet_length = rdata->packet_length;
@@ -251,7 +251,7 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
 	return (1);
 
 err:
-	free(rdata->rbuf.buf);
+	ssl3_release_buffer(&rdata->rbuf);
 
 init_err:
 	SSLerror(s, ERR_R_INTERNAL_ERROR);
diff --git a/src/lib/libssl/ssl_both.c b/src/lib/libssl/ssl_both.c
index 488a5ff7c9..dff44ecd41 100644
--- a/src/lib/libssl/ssl_both.c
+++ b/src/lib/libssl/ssl_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_both.c,v 1.18 2020/05/19 16:35:20 jsing Exp $ */
+/* $OpenBSD: ssl_both.c,v 1.19 2020/09/24 17:59:54 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -708,7 +708,7 @@ ssl3_setup_read_buffer(SSL *s)
 		S3I(s)->rbuf.len = len;
 	}
 
-	s->internal->packet = &(S3I(s)->rbuf.buf[0]);
+	s->internal->packet = S3I(s)->rbuf.buf;
 	return 1;
 
 err:
@@ -759,18 +759,22 @@ ssl3_setup_buffers(SSL *s)
 	return 1;
 }
 
-int
-ssl3_release_write_buffer(SSL *s)
+void
+ssl3_release_buffer(SSL3_BUFFER_INTERNAL *b)
 {
-	free(S3I(s)->wbuf.buf);
-	S3I(s)->wbuf.buf = NULL;
-	return 1;
+	freezero(b->buf, b->len);
+	b->buf = NULL;
+	b->len = 0;
 }
 
-int
+void
 ssl3_release_read_buffer(SSL *s)
 {
-	free(S3I(s)->rbuf.buf);
-	S3I(s)->rbuf.buf = NULL;
-	return 1;
+	ssl3_release_buffer(&S3I(s)->rbuf);
+}
+
+void
+ssl3_release_write_buffer(SSL *s)
+{
+	ssl3_release_buffer(&S3I(s)->wbuf);
 }
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index a3b8a80572..d4ba7f66d4 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.293 2020/09/17 15:23:29 jsing Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.294 2020/09/24 17:59:54 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1223,8 +1223,9 @@ int	ssl3_setup_buffers(SSL *s);
 int	ssl3_setup_init_buffer(SSL *s);
 int	ssl3_setup_read_buffer(SSL *s);
 int	ssl3_setup_write_buffer(SSL *s);
-int	ssl3_release_read_buffer(SSL *s);
-int	ssl3_release_write_buffer(SSL *s);
+void ssl3_release_buffer(SSL3_BUFFER_INTERNAL *b);
+void ssl3_release_read_buffer(SSL *s);
+void ssl3_release_write_buffer(SSL *s);
 int	ssl3_new(SSL *s);
 void	ssl3_free(SSL *s);
 int	ssl3_accept(SSL *s);
-- 
cgit v1.2.3-55-g6feb