SSL: workaround for i2d_SSL_SESSION() negative values

i2d_SSL_SESSION() may unexpectedly return a negative value on
memory allocation failure, even though the NULL buffer was passed,
notably in LibreSSL.

Reported by szzzy.

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 24ec9b668a45b3134c1b8af8fd2ea7108621dacf..670dfefb035876e3e95608f0cd39e9233bbebe9d 100644 (file)
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -4462,7 +4462,7 @@ ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
 
     /* do not cache too big session */
 
-    if (len > NGX_SSL_MAX_SESSION_SIZE) {
+    if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) {
         return 0;
     }
 

diff --git a/src/http/ngx_http_upstream_round_robin.c b/src/http/ngx_http_upstream_round_robin.c
index 7b8c07414118dd950ec50d0d0871e1f0717ae0ca..8f9bcfcf05b2e7c468f56c4b71151d38f0190276 100644 (file)
--- a/src/http/ngx_http_upstream_round_robin.c
+++ b/src/http/ngx_http_upstream_round_robin.c
@@ -1196,7 +1196,7 @@ ngx_http_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc,
 
         /* do not cache too big session */
 
-        if (len > NGX_SSL_MAX_SESSION_SIZE) {
+        if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) {
             return;
         }
 

diff --git a/src/stream/ngx_stream_upstream_round_robin.c b/src/stream/ngx_stream_upstream_round_robin.c
index c323321b391c1b1bf2725489ece2d947a7e8fe11..b4ea9a0af8cda75edfce0e7a990aebc58fae10fa 100644 (file)
--- a/src/stream/ngx_stream_upstream_round_robin.c
+++ b/src/stream/ngx_stream_upstream_round_robin.c
@@ -1027,7 +1027,7 @@ ngx_stream_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc,
 
         /* do not cache too big session */
 
-        if (len > NGX_SSL_MAX_SESSION_SIZE) {
+        if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) {
             return;
         }