Heap corruption caused by double freeing

[gknocke]

We have some code looking like this:
BIO *b=BIO_new...;
...
if(b)
BIO_free(b)

Unfortunately, this leads to heap corruptions: If(b) does not work and will return TRUE even though b is freed. So if you clean up and the value is free already, it will be double-freed.

My workaround is to add b=NULL; after each call of b in case it is not the very last one. Then, if(b) works. Unfortunately, there is no way to check wether a value has already been freed. A more elegant way would be to code in such a way that only one "free" is used and we never need to check whether a value has been freed.

The problem is not Openssl-specific but holds for everything we allocate memory for.

I found this in my own code, though I'm pretty sure we have some of them in the C library, too.