generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make sure to remove bad sessions in SSL_clear() (found by Yoram Zahavi).

Browse Source
This commit is contained in:
Lutz Jänicke
2002-02-26 21:50:28 +00:00
parent 03a6dcdf31
commit ce1e801013
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -4,6 +4,10 @@
Changes between 0.9.6c and 0.9.6d [XX xxx XXXX]
*) Fix bug in SSL_clear(): bad sessions were not removed (found by
Yoram Zahavi <YoramZ@gilian.com>).
[Lutz Jaenicke]
*) Add information about CygWin 1.3 and on, and preserve proper
configuration for the versions before that.
[Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]

14
ssl/ssl_lib.c
View File

@@ -85,7 +85,6 @@ OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
int SSL_clear(SSL *s)
{
int state;
if (s->method == NULL)
{
@@ -110,9 +109,14 @@ int SSL_clear(SSL *s)
}
#endif
state=s->state; /* Keep to check if we throw away the session-id */
s->type=0;
if (ssl_clear_bad_session(s))
{
SSL_SESSION_free(s->session);
s->session=NULL;
}
s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT);
s->version=s->method->version;
@@ -131,12 +135,6 @@ int SSL_clear(SSL *s)
ssl_clear_cipher_ctx(s);
if (ssl_clear_bad_session(s))
{
SSL_SESSION_free(s->session);
s->session=NULL;
}
s->first_packet=0;
#if 1