Clear old messages from queues in order to avoid leaks of record layer objects.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22275)

diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index ae76ddb3f45ef5d1a2345235c99837cbfa402eb1..e17154d952a70014ed47efecf30f30d8318db7c6 100644 (file)
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -758,6 +758,14 @@ int tls13_change_cipher_state(SSL_CONNECTION *s, int which)
                ? OSSL_RECORD_PROTECTION_LEVEL_HANDSHAKE
                : OSSL_RECORD_PROTECTION_LEVEL_APPLICATION);
 
+    if (SSL_CONNECTION_IS_DTLS(s)) {
+        /* We have moved to the next flight lets clear out old messages */
+        if (direction == OSSL_RECORD_DIRECTION_READ)
+            dtls1_clear_received_buffer(s);
+        else
+            dtls1_clear_sent_buffer(s);
+    }
+
     if (!ssl_set_new_record_layer(s, s->version,
                                   direction,
                                   level, secret, hashlen, key, keylen, iv,

diff --git a/test/tls13secretstest.c b/test/tls13secretstest.c
index 2cbc4521308204694ace53bb09ee4f713bcc8810..5109857ec32983c125bc01a7450ff04d9a7659d1 100644 (file)
--- a/test/tls13secretstest.c
+++ b/test/tls13secretstest.c
@@ -236,6 +236,14 @@ int ssl_set_new_record_layer(SSL_CONNECTION *s, int version, int direction,
     return 0;
 }
 
+void dtls1_clear_received_buffer(SSL_CONNECTION *s)
+{
+}
+
+void dtls1_clear_sent_buffer(SSL_CONNECTION *s)
+{
+}
+
 /* End of mocked out code */
 
 static int test_secret(SSL_CONNECTION *s, unsigned char *prk,