From: Dr. Stephen Henson <steve@openssl.org>
Date: Wed, 17 Oct 2007 17:31:57 +0000 (+0000)
Subject: Don't lookup zero length session ID.
X-Git-Tag: OpenSSL_0_9_8k^2~640
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=3d3bf9c73029cdc8101bece5a9e15325920ad3a2;p=oweals%2Fopenssl.git

Don't lookup zero length session ID.
PR: 1591
---

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index c408b074e2..2e44a7aebd 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -435,10 +435,12 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
 		fatal = 1;
 		goto err;
 		}
-	else if (r == 0)
+	else if (r == 0 || (!ret || !len))
 		goto err;
 	else if (!ret && !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
 #else
+	if (len == 0)
+		goto err;
 	if (!(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
 #endif
 		{