From 3fa29765fd654361f9070502139c31c40595ef7b Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sun, 10 Oct 2010 12:27:19 +0000 Subject: [PATCH] PR: 2314 Submitted by: Mounir IDRASSI Reviewed by: steve Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 --- CHANGES | 3 +++ ssl/s3_clnt.c | 1 + 2 files changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index 4d7834360..ae4731851 100644 --- a/CHANGES +++ b/CHANGES @@ -893,6 +893,9 @@ Changes between 0.9.8o and 0.9.8p [xx XXX xxxx] + *) Fix for double free bug in ssl/s3_clnt.c CVE-2010-2939 + [Steve Henson] + *) Don't reencode certificate when calculating signature: cache and use the original encoding instead. This makes signature verification of some broken encodings work correctly. diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 99b2f4928..8b74e9f53 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -1509,6 +1509,7 @@ int ssl3_get_key_exchange(SSL *s) s->session->sess_cert->peer_ecdh_tmp=ecdh; ecdh=NULL; BN_CTX_free(bn_ctx); + bn_ctx = NULL; EC_POINT_free(srvr_ecpoint); srvr_ecpoint = NULL; }