d1_lib.c segmentation fault

[Qun-Ying]

Hi,

My colleague found this bug in d1_lib.c:dtls1_clear_queues().

Where the data field of the item pop from s->d1->buffered_app_data.q
is treated as hm_fragment, which result in segmentation fault when
free.

Attached is a attempted fix.

-- 
Qun-Ying

diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 2287ba6..7d9d91f 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -202,9 +202,12 @@ static void dtls1_clear_queues(SSL *s)
 
 	while ( (item = pqueue_pop(s->d1->buffered_app_data.q)) != NULL)
 		{
-		frag = (hm_fragment *)item->data;
-		OPENSSL_free(frag->fragment);
-		OPENSSL_free(frag);
+		rdata = (DTLS1_RECORD_DATA *) item->data;
+		if (rdata->rbuf.buf)
+			{
+			OPENSSL_free(rdata->rbuf.buf);
+			}
+		OPENSSL_free(item->data);
 		pitem_free(item);
 		}
 	}