generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Reorder cleanup sequence in SSL_CTX_free() to leave ex_data for remove_cb().

Browse Source 
Submitted by:
Reviewed by:
PR: 212
This commit is contained in:
Lutz Jänicke 2002-08-16 17:02:30 +00:00
parent a64f08f3dd
commit 68a9ee13e8
2 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES
View File

@ -1672,6 +1672,12 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
Changes between 0.9.6g and 0.9.6h [xx XXX xxxx] Changes between 0.9.6g and 0.9.6h [xx XXX xxxx]
*) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
the cached sessions are flushed, as the remove_cb() might use ex_data
contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com>
(see [openssl.org #212]).
[Geoff Thorpe, Lutz Jaenicke]
*) Fix typo in OBJ_txt2obj which incorrectly passed the content *) Fix typo in OBJ_txt2obj which incorrectly passed the content
length, instead of the encoding length to d2i_ASN1_OBJECT. length, instead of the encoding length to d2i_ASN1_OBJECT.
[Steve Henson] [Steve Henson]

17
ssl/ssl_lib.c
View File

@ -1405,13 +1405,24 @@ void SSL_CTX_free(SSL_CTX *a)
abort(); /* ok */ abort(); /* ok */
} }
#endif #endif
/*
* Free internal session cache. However: the remove_cb() may reference
* the ex_data of SSL_CTX, thus the ex_data store can only be removed
* after the sessions were flushed.
* As the ex_data handling routines might also touch the session cache,
* the most secure solution seems to be: empty (flush) the cache, then
* free ex_data, then finally free the cache.
* (See ticket [openssl.org #212].)
*/
if (a->sessions != NULL)
SSL_CTX_flush_sessions(a,0);
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
if (a->sessions != NULL) if (a->sessions != NULL)
{
SSL_CTX_flush_sessions(a,0);
lh_free(a->sessions); lh_free(a->sessions);
}
if (a->cert_store != NULL) if (a->cert_store != NULL)
X509_STORE_free(a->cert_store); X509_STORE_free(a->cert_store);
if (a->cipher_list != NULL) if (a->cipher_list != NULL)