Only inherit the session ID context in SSL_set_SSL_CTX if the existing

context was also inherited (matches that of the existing SSL_CTX).

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit ac8e9cbe14b59dacfe4ac52bc5ff06f8003e9b01)

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 64c9eabdd61a3d56f15897c8cba44ccb97ee6e31..c44bcd255c50b76521d88b02b22900a253d006e8 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -3194,24 +3194,31 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
                        }
                ssl_cert_free(ocert);
                }
-       CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
-       if (ssl->ctx != NULL)
-               SSL_CTX_free(ssl->ctx); /* decrement reference count */
-       ssl->ctx = ctx;
 
-       /*
-        * Inherit the session ID context as it is typically set from the
-        * parent SSL_CTX, and can vary with the CTX.
-        * Note that per-SSL SSL_set_session_id_context() will not persist
-        * if called before SSL_set_SSL_CTX.
-        */
-       ssl->sid_ctx_length = ctx->sid_ctx_length;
        /*
         * Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH),
         * so setter APIs must prevent invalid lengths from entering the system.
         */
-       OPENSSL_assert(ssl->sid_ctx_length <= sizeof ssl->sid_ctx);
-       memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
+       OPENSSL_assert(ssl->sid_ctx_length <= sizeof(ssl->sid_ctx));
+
+       /*
+        * If the session ID context matches that of the parent SSL_CTX,
+        * inherit it from the new SSL_CTX as well. If however the context does
+        * not match (i.e., it was set per-ssl with SSL_set_session_id_context),
+        * leave it unchanged.
+        */
+       if ((ssl->ctx != NULL) &&
+               (ssl->sid_ctx_length == ssl->ctx->sid_ctx_length) &&
+               (memcmp(ssl->sid_ctx, ssl->ctx->sid_ctx, ssl->sid_ctx_length) == 0))
+               {
+               ssl->sid_ctx_length = ctx->sid_ctx_length;
+               memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
+               }
+
+       CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
+       if (ssl->ctx != NULL)
+               SSL_CTX_free(ssl->ctx); /* decrement reference count */
+       ssl->ctx = ctx;
 
        return(ssl->ctx);
        }