tls-peer: Fix memory leak when processing Finished messages with TLS 1.3 fails

Fixes: 7a2b02667c30 ("libtls: Implement TLS 1.3 handshake on client-side")

diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c
index bfdba3eab30d1dd0689f1ab4945db3d2fcaba5dd..ed2031128c5cf3b121908fa65d13d7a10f39115a 100644 (file)
--- a/src/libtls/tls_peer.c
+++ b/src/libtls/tls_peer.c
@@ -1013,7 +1013,7 @@ static status_t process_hello_done(private_tls_peer_t *this,
  */
 static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
 {
-       chunk_t received, verify_data;
+       chunk_t received, verify_data = chunk_empty;
        u_char buf[12];
 
        if (this->tls->get_version_max(this->tls) < TLS_1_3)
@@ -1040,7 +1040,7 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
                {
                        DBG1(DBG_TLS, "calculating server finished failed");
                        this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
-                       return NEED_MORE;
+                       goto out;
                }
        }
 
@@ -1048,16 +1048,17 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
        {
                DBG1(DBG_TLS, "received server finished invalid");
                this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
-               return NEED_MORE;
+               goto out;
        }
 
-       if (verify_data.ptr != buf)
+       this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
+       this->state = STATE_FINISHED_RECEIVED;
+
+out:
+       if (verify_data.ptr && verify_data.ptr != buf)
        {
                chunk_free(&verify_data);
        }
-
-       this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
-       this->state = STATE_FINISHED_RECEIVED;
        return NEED_MORE;
 }