From 5716364b9c6519617677661a440770111ddf1dd6 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Fri, 1 Jul 2016 16:41:09 -0400 Subject: [PATCH] crypto/tls: Fix c.in.decrypt error handling. readRecord was not returning early if c.in.decrypt failed and ran through the rest of the function. It does set c.in.err, so the various checks in the callers do ultimately notice before acting on the result, but we should avoid running the rest of the function at all. Also rename 'err' to 'alertValue' since it isn't actually an error. Change-Id: I6660924716a85af704bd3fe81521b34766238695 Reviewed-on: https://go-review.googlesource.com/24709 Run-TryBot: Adam Langley TryBot-Result: Gobot Gobot Reviewed-by: Adam Langley --- conn.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/conn.go b/conn.go index 20b3d73..6fd4864 100644 --- a/conn.go +++ b/conn.go @@ -632,9 +632,10 @@ Again: // Process message. b, c.rawInput = c.in.splitBlock(b, recordHeaderLen+n) - ok, off, err := c.in.decrypt(b) + ok, off, alertValue := c.in.decrypt(b) if !ok { - c.in.setErrorLocked(c.sendAlert(err)) + c.in.freeBlock(b) + return c.in.setErrorLocked(c.sendAlert(alertValue)) } b.off = off data := b.data[b.off:]