The branch OpenSSL_1_1_1-stable has been updated via 9008dc9e38bc35541957eacebafac35912d20821 (commit) from a0f0e6f38009a4a93bd724f6f9c741c413be22d4 (commit)
- Log ----------------------------------------------------------------- commit 9008dc9e38bc35541957eacebafac35912d20821 Author: Todd Short <tsh...@akamai.com> Date: Wed May 26 10:03:35 2021 -0400 Call SSLfatal when the generate_ticket_cb returns 0 Otherwise, the state machine ends up being in a bad state: ``` SSL routines:write_state_machine:missing fatal:ssl/statem/statem.c:850: ``` Reviewed-by: Matt Caswell <m...@openssl.org> Reviewed-by: Ben Kaduk <ka...@mit.edu> (Merged from https://github.com/openssl/openssl/pull/15485) ----------------------------------------------------------------------- Summary of changes: ssl/statem/statem_srvr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index fec12f6130..30d20f1297 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -4139,9 +4139,12 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt) } if (tctx->generate_ticket_cb != NULL && - tctx->generate_ticket_cb(s, tctx->ticket_cb_data) == 0) + tctx->generate_ticket_cb(s, tctx->ticket_cb_data) == 0) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, + ERR_R_INTERNAL_ERROR); goto err; - + } /* * If we are using anti-replay protection then we behave as if * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there