From eb490aabf6a9f47c074ec476d0d4997c2362cdbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=90=B4=E6=95=AC=E8=BE=89?= <11137405@vivo.com>
Date: Mon, 29 Nov 2021 10:46:35 +0800
Subject: [PATCH 1/2] [session] fix a session copy bug fix a possible double
 reference on 'ticket' when peer_cert/peer_cert_digest calloc failed.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: 吴敬辉 <11137405@vivo.com>
---
 library/ssl_tls.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 3c1e917598..962d625435 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -301,6 +301,10 @@ static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session
     mbedtls_ssl_session_free( dst );
     memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
 
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
+    dst->ticket = NULL;
+#endif
+
 #if defined(MBEDTLS_X509_CRT_PARSE_C)
     if( src->peer_cert != NULL )
     {

From 18504f4b206d6c6d197ffec398bdd60a76b811c7 Mon Sep 17 00:00:00 2001
From: David Horstmann <david.horstmann@arm.com>
Date: Wed, 8 Dec 2021 13:28:12 +0000
Subject: [PATCH 2/2] Add changelog entry for session copy bugfix

Signed-off-by: David Horstmann <david.horstmann@arm.com>
---
 ChangeLog.d/fix-session-copy-bug.txt | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 ChangeLog.d/fix-session-copy-bug.txt

diff --git a/ChangeLog.d/fix-session-copy-bug.txt b/ChangeLog.d/fix-session-copy-bug.txt
new file mode 100644
index 0000000000..46e3d8ef61
--- /dev/null
+++ b/ChangeLog.d/fix-session-copy-bug.txt
@@ -0,0 +1,6 @@
+Bugfix
+   * Fix a double-free that happened after mbedtls_ssl_set_session() or
+     mbedtls_ssl_get_session() failed with MBEDTLS_ERR_SSL_ALLOC_FAILED
+     (out of memory). After that, calling mbedtls_ssl_session_free()
+     and mbedtls_ssl_free() would cause an internal session buffer to
+     be free()'d twice.