From: Joshua Rogers <MegaManSec@users.noreply.github.com>
Date: Sat, 11 Oct 2025 21:39:25 +0000 (+0800)
Subject: crypto/bio/bss_acpt: reset accept_sock and b->num after close in ACPT_S_LISTEN failures
X-Git-Tag: 3.6-PRE-CLANG-FORMAT-WEBKIT~42
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2af29ddebad7ad0a2f0a3327da7eb7c1ef5e5bf7;p=thirdparty%2Fopenssl.git

crypto/bio/bss_acpt: reset accept_sock and b->num after close in ACPT_S_LISTEN failures

On BIO_listen or BIO_sock_info failure we close the socket but leave
accept_sock and b->num pointing at the old fd. Later cleanup can double
close.

Set both to INVALID_SOCKET immediately after BIO_closesocket.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28904)

(cherry picked from commit 1c4f7b10358b79a0b33619187caa2b7e3bdb6e7a)
---

diff --git a/crypto/bio/bss_acpt.c b/crypto/bio/bss_acpt.c
index 7c55cc05def..881cfe50ca4 100644
--- a/crypto/bio/bss_acpt.c
+++ b/crypto/bio/bss_acpt.c
@@ -248,6 +248,8 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
                                 BIO_ADDRINFO_address(c->addr_iter),
                                 c->bind_mode)) {
                     BIO_closesocket(c->accept_sock);
+                    c->accept_sock = (int)INVALID_SOCKET;
+                    b->num = (int)INVALID_SOCKET;
                     goto exit_loop;
                 }
             }
@@ -259,6 +261,8 @@ static int acpt_state(BIO *b, BIO_ACCEPT *c)
                 if (!BIO_sock_info(c->accept_sock, BIO_SOCK_INFO_ADDRESS,
                                    &info)) {
                     BIO_closesocket(c->accept_sock);
+                    c->accept_sock = (int)INVALID_SOCKET;
+                    b->num = (int)INVALID_SOCKET;
                     goto exit_loop;
                 }
             }