From ab6ba99484b637bad0c5a5fa2c590834c14746c7 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Fri, 1 Jul 2016 16:41:09 -0400 Subject: [PATCH] crypto/tls: Fix c.in.decrypt error handling. readRecord was not returning early if c.in.decrypt failed and ran through the rest of the function. It does set c.in.err, so the various checks in the callers do ultimately notice before acting on the result, but we should avoid running the rest of the function at all. Also rename 'err' to 'alertValue' since it isn't actually an error. Change-Id: I6660924716a85af704bd3fe81521b34766238695 Reviewed-on: https://go-review.googlesource.com/24709 Run-TryBot: Adam Langley TryBot-Result: Gobot Gobot Reviewed-by: Adam Langley --- src/crypto/tls/conn.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/crypto/tls/conn.go b/src/crypto/tls/conn.go index 20b3d735ff..6fd486462f 100644 --- a/src/crypto/tls/conn.go +++ b/src/crypto/tls/conn.go @@ -632,9 +632,10 @@ Again: // Process message. b, c.rawInput = c.in.splitBlock(b, recordHeaderLen+n) - ok, off, err := c.in.decrypt(b) + ok, off, alertValue := c.in.decrypt(b) if !ok { - c.in.setErrorLocked(c.sendAlert(err)) + c.in.freeBlock(b) + return c.in.setErrorLocked(c.sendAlert(alertValue)) } b.off = off data := b.data[b.off:] -- 2.48.1