A null pointer dereference occurs when memory allocation fails

Fixes #21605 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from #21606) (cherry picked from commit a8da305)
openssl · Aug 2, 2023 · cf011de · cf011de
1 parent a24eaa8
commit cf011de
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
@@ -198,8 +198,11 @@ SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket)
     dest->references = 1;
 
     dest->lock = CRYPTO_THREAD_lock_new();
-    if (dest->lock == NULL)
+    if (dest->lock == NULL) {
+        OPENSSL_free(dest);
+        dest = NULL;
         goto err;
+    }
 
     if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, dest, &dest->ex_data))
         goto err;