X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fssl_lib.c;h=ea76cf11728e1e66ee30a20ee60e14d37e62d9a3;hp=eda3cfd11631854399b85f41dbf3e13108b08080;hb=2e60ea7634125fcad082cc4b493e429ee440ea83;hpb=7ef524ea1cc26f3f992235156e43d15e8bb6b244

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index eda3cfd116..ea76cf1172 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -125,6 +125,7 @@
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
 #include <openssl/x509v3.h>
+#include "cryptlib.h"
 
 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
@@ -277,6 +278,7 @@ SSL *SSL_new(SSL_CTX *ctx)
 	s->verify_mode=ctx->verify_mode;
 	s->verify_depth=ctx->verify_depth;
 	s->sid_ctx_length=ctx->sid_ctx_length;
+	OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
 	memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
 	s->verify_callback=ctx->default_verify_callback;
 	s->generate_session_id=ctx->generate_session_id;
@@ -318,7 +320,7 @@ err:
 int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
 				   unsigned int sid_ctx_len)
     {
-    if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
+    if(sid_ctx_len > sizeof ctx->sid_ctx)
 	{
 	SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
 	return 0;
@@ -368,6 +370,10 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
 	 * any new session built out of this id/id_len and the ssl_version in
 	 * use by this SSL. */
 	SSL_SESSION r, *p;
+
+	if(id_len > sizeof r.session_id)
+		return 0;
+
 	r.ssl_version = ssl->version;
 	r.session_id_length = id_len;
 	memcpy(r.session_id, id, id_len);
@@ -1067,14 +1073,17 @@ int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
  * preference */
 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
 	{
-	if ((s != NULL) && (s->cipher_list != NULL))
-		{
-		return(s->cipher_list);
-		}
-	else if ((s->ctx != NULL) &&
-		(s->ctx->cipher_list != NULL))
+	if (s != NULL)
 		{
-		return(s->ctx->cipher_list);
+		if (s->cipher_list != NULL)
+			{
+			return(s->cipher_list);
+			}
+		else if ((s->ctx != NULL) &&
+			(s->ctx->cipher_list != NULL))
+			{
+			return(s->ctx->cipher_list);
+			}
 		}
 	return(NULL);
 	}
@@ -1083,14 +1092,17 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
  * algorithm id */
 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
 	{
-	if ((s != NULL) && (s->cipher_list_by_id != NULL))
-		{
-		return(s->cipher_list_by_id);
-		}
-	else if ((s != NULL) && (s->ctx != NULL) &&
-		(s->ctx->cipher_list_by_id != NULL))
+	if (s != NULL)
 		{
-		return(s->ctx->cipher_list_by_id);
+		if (s->cipher_list_by_id != NULL)
+			{
+			return(s->cipher_list_by_id);
+			}
+		else if ((s->ctx != NULL) &&
+			(s->ctx->cipher_list_by_id != NULL))
+			{
+			return(s->ctx->cipher_list_by_id);
+			}
 		}
 	return(NULL);
 	}
@@ -1409,13 +1421,24 @@ void SSL_CTX_free(SSL_CTX *a)
 		abort(); /* ok */
 		}
 #endif
-	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
 
+	/*
+	 * Free internal session cache. However: the remove_cb() may reference
+	 * the ex_data of SSL_CTX, thus the ex_data store can only be removed
+	 * after the sessions were flushed.
+	 * As the ex_data handling routines might also touch the session cache,
+	 * the most secure solution seems to be: empty (flush) the cache, then
+	 * free ex_data, then finally free the cache.
+	 * (See ticket [openssl.org #212].)
+	 */
 	if (a->sessions != NULL)
-		{
 		SSL_CTX_flush_sessions(a,0);
+
+	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
+
+	if (a->sessions != NULL)
 		lh_free(a->sessions);
-		}
+
 	if (a->cert_store != NULL)
 		X509_STORE_free(a->cert_store);
 	if (a->cipher_list != NULL)
@@ -1792,7 +1815,7 @@ void ssl_update_cache(SSL *s,int mode)
 
 	i=s->ctx->session_cache_mode;
 	if ((i & mode) && (!s->hit)
-		&& ((i & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)
+		&& ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE)
 		    || SSL_CTX_add_session(s->ctx,s->session))
 		&& (s->ctx->new_session_cb != NULL))
 		{
@@ -2024,6 +2047,7 @@ SSL *SSL_dup(SSL *s)
 		 * they should not both point to the same object,
 		 * and thus we can't use SSL_copy_session_id. */
 
+		ret->method->ssl_free(ret);
 		ret->method = s->method;
 		ret->method->ssl_new(ret);