ssl_session_dup() missing ext.alpn_session

Properly copy ext.alpn_session in ssl_session_dup()
Use OPENSSL_strndup() as that's used in ssl_asn1.c

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/3770)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index df992bd2f3c9f50f27da5b7dd6fea5022f32ef87..e7fe714e58a982cf2e2f6aa59fd60c02545fb602 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -122,6 +122,7 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
     dest->ext.supportedgroups = NULL;
 #endif
     dest->ext.tick = NULL;
+    dest->ext.alpn_selected = NULL;
 #ifndef OPENSSL_NO_SRP
     dest->srp_username = NULL;
 #endif
@@ -212,6 +213,15 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
         dest->ext.ticklen = 0;
     }
 
+    if (src->ext.alpn_selected) {
+        dest->ext.alpn_selected =
+            (unsigned char*)OPENSSL_strndup((char*)src->ext.alpn_selected,
+                                            src->ext.alpn_selected_len);
+        if (dest->ext.alpn_selected == NULL) {
+            goto err;
+        }
+    }
+
 #ifndef OPENSSL_NO_SRP
     if (src->srp_username) {
         dest->srp_username = OPENSSL_strdup(src->srp_username);