From bfef0480fb6a6e4802c6507f4accd8df866a7aa6 Mon Sep 17 00:00:00 2001 From: aidan garske Date: Thu, 25 Jun 2026 14:29:34 -0700 Subject: [PATCH] F-5760 - Only free standalone BIOs in ssl_set_bio to avoid chained free UAF --- src/ssl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/ssl.c b/src/ssl.c index c2a5827c9d..1365f6f78f 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -6203,16 +6203,16 @@ int wolfSSL_set_compression(WOLFSSL* ssl) * a chain */ if ((flags & WOLFSSL_BIO_FLAG_READ) && (ssl->biord != NULL)) { if ((flags & WOLFSSL_BIO_FLAG_WRITE) && (ssl->biord != ssl->biowr)) { - if (ssl->biowr != NULL && ssl->biowr->prev != NULL) + if (ssl->biowr != NULL && ssl->biowr->prev == NULL) wolfSSL_BIO_free(ssl->biowr); ssl->biowr = NULL; } - if (ssl->biord->prev != NULL) + if (ssl->biord->prev == NULL) wolfSSL_BIO_free(ssl->biord); ssl->biord = NULL; } else if ((flags & WOLFSSL_BIO_FLAG_WRITE) && (ssl->biowr != NULL)) { - if (ssl->biowr->prev != NULL) + if (ssl->biowr->prev == NULL) wolfSSL_BIO_free(ssl->biowr); ssl->biowr = NULL; }