From 3d3bf9c73029cdc8101bece5a9e15325920ad3a2 Mon Sep 17 00:00:00 2001
From: "Dr. Stephen Henson" <steve@openssl.org>
Date: Wed, 17 Oct 2007 17:31:57 +0000
Subject: [PATCH] Don't lookup zero length session ID. PR: 1591
---
ssl/ssl_sess.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index c408b074e2..2e44a7aebd 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -435,10 +435,12 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
fatal = 1;
goto err;
}
- else if (r == 0)
+ else if (r == 0 || (!ret || !len))
goto err;
else if (!ret && !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
#else
+ if (len == 0)
+ goto err;
if (!(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
#endif
{
--
2.25.1