Ensure the rrl object is set to NULL after it is freed

Once we free the rrl object we should NULL it to prevent a dangling ref
to it. Otherwise we could get a double free.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18132)

diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c
index 807cc43c15da12ee46096bd407f28a3d12f3132d..c187141ee9807ae6d8fde1d55815cf64c2d73620 100644 (file)
--- a/ssl/record/rec_layer_s3.c
+++ b/ssl/record/rec_layer_s3.c
@@ -1774,6 +1774,7 @@ int ssl_set_new_record_layer(SSL_CONNECTION *s, int version,
         return 0;
     }
 
+    s->rlayer.rrl = NULL;
     if (meth != NULL)
         s->rlayer.rrlmethod = meth;