From 1415d31626f691d87ce513991d1b633fb464be72 Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Wed, 22 Feb 2017 11:59:44 +0100 Subject: [PATCH] Add some more consistency checks in tls_decrypt_ticket. Reviewed-by: Richard Levitte Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/2704) (cherry picked from commit 79020b27beff060d02830870fdfd821fe8cbd439) --- ssl/t1_lib.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index d07a9f0e83..acef270047 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -3579,6 +3579,11 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, sess = d2i_SSL_SESSION(NULL, &p, slen); OPENSSL_free(sdec); if (sess) { + /* Some additional consistency checks */ + if (p != sdec + slen || sess->session_id_length != 0) { + SSL_SESSION_free(sess); + return 2; + } /* * The session ID, if non-empty, is used by some clients to detect * that the ticket has been accepted. So we copy it to the session -- 2.25.1