From: Alex Gaynor <alex.gaynor@gmail.com>
Date: Wed, 7 Sep 2016 13:41:20 +0000 (-0400)
Subject: GH1537: Avoid double-free in the EVP_PKEY API
X-Git-Tag: OpenSSL_1_1_1-pre1~3589
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d65c3615f6c658478503f4862f8055203a98038c;p=openssl

GH1537: Avoid double-free in the EVP_PKEY API

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
---

diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
index a4dcf581c7..9828620552 100644
--- a/crypto/evp/p_lib.c
+++ b/crypto/evp/p_lib.c
@@ -398,6 +398,7 @@ void EVP_PKEY_free(EVP_PKEY *x)
         return;
     REF_ASSERT_ISNT(i < 0);
     EVP_PKEY_free_it(x);
+    CRYPTO_THREAD_lock_free(x->lock);
     sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
     OPENSSL_free(x);
 }
@@ -413,7 +414,6 @@ static void EVP_PKEY_free_it(EVP_PKEY *x)
     ENGINE_finish(x->engine);
     x->engine = NULL;
 #endif
-    CRYPTO_THREAD_lock_free(x->lock);
 }
 
 static int unsup_alg(BIO *out, const EVP_PKEY *pkey, int indent,