From: Vadim Zhestikov <v.zhestikov@f5.com>
Date: Wed, 22 Jul 2026 23:10:18 +0000 (-0700)
Subject: SSL: workaround for i2d_SSL_SESSION() negative values
X-Git-Tag: release-1.31.8~13
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=faf94389890f4fd598464f70ae0911c01e40b6ab;p=nginx.git

SSL: workaround for i2d_SSL_SESSION() negative values

i2d_SSL_SESSION() may unexpectedly return a negative value on
memory allocation failure, even though the NULL buffer was passed,
notably in LibreSSL.

Reported by szzzy.
---

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 24ec9b668..670dfefb0 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -4462,7 +4462,7 @@ ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
 
     /* do not cache too big session */
 
-    if (len > NGX_SSL_MAX_SESSION_SIZE) {
+    if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) {
         return 0;
     }
 
diff --git a/src/http/ngx_http_upstream_round_robin.c b/src/http/ngx_http_upstream_round_robin.c
index 7b8c07414..8f9bcfcf0 100644
--- a/src/http/ngx_http_upstream_round_robin.c
+++ b/src/http/ngx_http_upstream_round_robin.c
@@ -1196,7 +1196,7 @@ ngx_http_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc,
 
         /* do not cache too big session */
 
-        if (len > NGX_SSL_MAX_SESSION_SIZE) {
+        if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) {
             return;
         }
 
diff --git a/src/stream/ngx_stream_upstream_round_robin.c b/src/stream/ngx_stream_upstream_round_robin.c
index c323321b3..b4ea9a0af 100644
--- a/src/stream/ngx_stream_upstream_round_robin.c
+++ b/src/stream/ngx_stream_upstream_round_robin.c
@@ -1027,7 +1027,7 @@ ngx_stream_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc,
 
         /* do not cache too big session */
 
-        if (len > NGX_SSL_MAX_SESSION_SIZE) {
+        if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) {
             return;
         }