From: Todd Short <tshort@akamai.com>
Date: Tue, 22 Dec 2015 16:49:36 +0000 (-0500)
Subject: Memory leak in state machine in error path
X-Git-Tag: OpenSSL_1_1_0-pre2~168
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c849c6d9d3bf806fecfe0c16eaa55d361979ff7f;p=openssl

Memory leak in state machine in error path

When EC is disabled, and an error occurs in ssl_generate_master_secret()
or RAND_bytes(), the error path does not free rsa_decrypt.

RT#4197

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
---

diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index 0e6f0d03dd..79254b5248 100644
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -2620,8 +2620,8 @@ MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt)
 #endif
 #ifndef OPENSSL_NO_EC
     EVP_PKEY_free(ckey);
-    OPENSSL_free(rsa_decrypt);
 #endif
+    OPENSSL_free(rsa_decrypt);
 #ifndef OPENSSL_NO_PSK
     OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen);
     s->s3->tmp.psk = NULL;