diff options
| -rw-r--r-- | ChangeLog | 1 | ||||
| -rw-r--r-- | src/IO/tls_openssl.c | 6 |
2 files changed, 6 insertions, 1 deletions
@@ -20,6 +20,7 @@ dillo-3.2.0 [Not released yet] GNU extensions. - Perform an emergency stop of the layout engine loop after 1000 iterations to prevent a hang. + - Fix use-after-free on errors in TLS connection. Patches: Rodrigo Arias Mallo +- Add primitive support for SVG using the nanosvg.h library. Patches: dogma, Rodrigo Arias Mallo diff --git a/src/IO/tls_openssl.c b/src/IO/tls_openssl.c index 3e68e928..5ad12b8c 100644 --- a/src/IO/tls_openssl.c +++ b/src/IO/tls_openssl.c @@ -1186,7 +1186,10 @@ static void Tls_connect(int fd, int connkey) if (a_Klist_get_data(conn_list, connkey)) { conn->connecting = FALSE; if (failed) { + conn->in_connect = FALSE; Tls_close_by_key(connkey); + /* conn is freed now */ + conn = NULL; } a_IOwatch_remove_fd(fd, DIO_READ|DIO_WRITE); a_Http_connect_done(fd, failed ? FALSE : TRUE); @@ -1195,7 +1198,8 @@ static void Tls_connect(int fd, int connkey) } } - conn->in_connect = FALSE; + if (conn) + conn->in_connect = FALSE; } static void Tls_connect_cb(int fd, void *vconnkey) |