mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-07-06 19:10:53 +02:00
Colton Willey
373b45cd7a
ssl->secure_renegotiation caches a pointer into extension data owned by the ssl->extensions list. Three call sites free that list via TLSX_FreeAll without NULLing the cached pointer, leaving it dangling: - wolfSSL_clear() - FreeHandshakeResources() (TLSX_FreeAll branch) - wolfSSL_ResourceFree() After wolfSSL_clear(), calling wolfSSL_SSL_get_secure_renegotiation_support() reads the freed SecureRenegotiation struct. Confirmed heap-use-after-free under ASan with nginx, haproxy, and openssl-compat build profiles. NULL the pointer at all three sites. Add regression test covering the wolfSSL_clear path.
Before creating any new configure files (.conf) read the CONF_FILES_README.md