From faf94389890f4fd598464f70ae0911c01e40b6ab Mon Sep 17 00:00:00 2001 From: Vadim Zhestikov Date: Wed, 22 Jul 2026 16:10:18 -0700 Subject: [PATCH] SSL: workaround for i2d_SSL_SESSION() negative values i2d_SSL_SESSION() may unexpectedly return a negative value on memory allocation failure, even though the NULL buffer was passed, notably in LibreSSL. Reported by szzzy. --- src/event/ngx_event_openssl.c | 2 +- src/http/ngx_http_upstream_round_robin.c | 2 +- src/stream/ngx_stream_upstream_round_robin.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index 24ec9b668..670dfefb0 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c @@ -4462,7 +4462,7 @@ ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess) /* do not cache too big session */ - if (len > NGX_SSL_MAX_SESSION_SIZE) { + if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) { return 0; } diff --git a/src/http/ngx_http_upstream_round_robin.c b/src/http/ngx_http_upstream_round_robin.c index 7b8c07414..8f9bcfcf0 100644 --- a/src/http/ngx_http_upstream_round_robin.c +++ b/src/http/ngx_http_upstream_round_robin.c @@ -1196,7 +1196,7 @@ ngx_http_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc, /* do not cache too big session */ - if (len > NGX_SSL_MAX_SESSION_SIZE) { + if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) { return; } diff --git a/src/stream/ngx_stream_upstream_round_robin.c b/src/stream/ngx_stream_upstream_round_robin.c index c323321b3..b4ea9a0af 100644 --- a/src/stream/ngx_stream_upstream_round_robin.c +++ b/src/stream/ngx_stream_upstream_round_robin.c @@ -1027,7 +1027,7 @@ ngx_stream_upstream_save_round_robin_peer_session(ngx_peer_connection_t *pc, /* do not cache too big session */ - if (len > NGX_SSL_MAX_SESSION_SIZE) { + if (len <= 0 || len > NGX_SSL_MAX_SESSION_SIZE) { return; }