From bf0fc41266f17311c5db1e0541d3dd12eb27deb6 Mon Sep 17 00:00:00 2001 From: Emilia Kasper Date: Thu, 1 Oct 2015 13:00:39 +0200 Subject: [PATCH] ssl_sess.c: grab a copy of the session ID The user callback takes a non-const pointer, so don't pass PACKET data to it directly; rather, grab a local copy. Reviewed-by: Matt Caswell --- ssl/ssl_sess.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index 83171f1f9f..41bc4e11a3 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -583,13 +583,15 @@ int ssl_get_prev_session(SSL *s, const PACKET *ext, const PACKET *session_id) if (try_session_cache && ret == NULL && s->session_ctx->get_session_cb != NULL) { int copy = 1; + /* The user callback takes a non-const pointer, so grab a local copy. */ + unsigned char *sid = NULL; + size_t sid_len; + if (!PACKET_memdup(session_id, &sid, &sid_len)) + goto err; + ret = s->session_ctx->get_session_cb(s, sid, sid_len, ©); + OPENSSL_free(sid); - /* - * TODO(openssl-team): grab a copy of the data in |session_id| - * so that the PACKET data can be made const. - */ - if ((ret = s->session_ctx->get_session_cb(s, PACKET_data(session_id), - len, ©))) { + if (ret != NULL) { s->session_ctx->stats.sess_cb_hit++; /* -- GitLab