Fix array bounds violation in ssl_session_dup