/* Provenance: openssl/openssl tls_free_buffers (fixed).
 * repo: openssl/openssl
 * commit: c88c3de51020c37e8706bf7a682a162593053aac
 * parent: 17765d9cefed8b4ada6548719beb98e22672a9bd
 * commit_url: https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac
 * cve: CVE-2024-4741
 * license: Apache-2.0
 * function: tls_free_buffers
 * relpath: ssl/record/methods/tls_common.c
 */

int tls_free_buffers(OSSL_RECORD_LAYER *rl)
{
    if (rl->direction == OSSL_RECORD_DIRECTION_WRITE) {
        if (rl->nextwbuf < rl->numwpipes) {
            /*
             * We may have pending data. If we've just got one empty buffer
             * allocated then it has probably just been alloc'd via
             * tls_alloc_buffers, and it is fine to free it. Otherwise this
             * looks like real pending data and it is an error.
             */
            if (rl->nextwbuf != 0
                    || rl->numwpipes != 1
                    || TLS_BUFFER_get_left(&rl->wbuf[0]) != 0)
                return 0;
        }
        tls_release_write_buffer(rl);
        return 1;
    }

    /* Read direction */

    /* If we have pending data to be read then fail */
    if (rl->curr_rec < rl->num_recs
            || rl->curr_rec != rl->num_released
            || TLS_BUFFER_get_left(&rl->rbuf) != 0
            || rl->rstate == SSL_ST_READ_BODY)
        return 0;

    return tls_release_read_buffer(rl);
}