don't memset(data,0,...) if data is NULL

[openssl.git] / ssl / ssl_sess.c

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 6424f775e21f785c1222e27fc57e04acebe4b4fa..ca1a7427be1116e5317a25aaadd46a8abcb6655d 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -60,6 +60,7 @@
 #include <openssl/lhash.h>
 #include <openssl/rand.h>
 #include "ssl_locl.h"
+#include "cryptlib.h"
 
 static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
 static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s);
@@ -250,6 +251,12 @@ int ssl_get_new_session(SSL *s, int session)
                ss->session_id_length=0;
                }
 
+       if (s->sid_ctx_length > sizeof ss->sid_ctx)
+               {
+               SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
+               SSL_SESSION_free(ss);
+               return 0;
+               }
        memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length);
        ss->sid_ctx_length=s->sid_ctx_length;
        s->session=ss;