From eddef305897cd8e9facbc18ed93a4ec104ab1927 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 21 Jul 2016 10:48:12 +0100 Subject: Fix BIO_push ref counting for SSL BIO When pushing a BIO onto an SSL BIO we set the rbio and wbio for the SSL object to be the BIO that has been pushed. Therefore we need to up the ref count for that BIO. The existing code was uping the ref count on the wrong BIO. Reviewed-by: Rich Salz --- ssl/bio_ssl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'ssl/bio_ssl.c') diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c index efe0df98fb..5212a7b239 100644 --- a/ssl/bio_ssl.c +++ b/ssl/bio_ssl.c @@ -327,8 +327,12 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr) break; case BIO_CTRL_PUSH: if ((next != NULL) && (next != ssl->rbio)) { + /* + * We are going to pass ownership of next to the SSL object...but + * we don't own a reference to pass yet - so up ref + */ + BIO_up_ref(next); SSL_set_bio(ssl, next, next); - BIO_up_ref(b); } break; case BIO_CTRL_POP: -- cgit v1.2.3