From ea6bd2645431a064394c746fba7013950ea04f78 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Sun, 8 Feb 2015 22:41:10 +0000 Subject: [PATCH] Correct reading back of tlsext_tick_lifetime_hint from ASN1. When writing out the hint, if the hint > 0, then we write it out otherwise we skip it. Previously when reading the hint back in, if were expecting to see one (because the ticket length > 0), but it wasn't present then we set the hint to -1, otherwise we set it to 0. This fails to set the hint to the same as when it was written out. The hint should never be negative because the RFC states the hint is unsigned. It is valid for a server to set the hint to 0 (this means the lifetime is unspecified according to the RFC). If the server set it to 0, it should still be 0 when we read it back in. Reviewed-by: Tim Hudson --- ssl/ssl_asn1.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c index b27e058bc7..63fe17f16e 100644 --- a/ssl/ssl_asn1.c +++ b/ssl/ssl_asn1.c @@ -569,9 +569,7 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, OPENSSL_free(ai.data); ai.data = NULL; ai.length = 0; - } else if (ret->tlsext_ticklen && ret->session_id_length) - ret->tlsext_tick_lifetime_hint = -1; - else + } else ret->tlsext_tick_lifetime_hint = 0; os.length = 0; os.data = NULL; -- 2.40.0