openssl: release ssl_session if sess_reuse_cb fails

Closes #19405

diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 59fd0cbd6de5b390db091dc612e488fde8927889..5c2711c58762f505d102be88a560cf09a7285ad4 100644 (file)
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -3775,8 +3775,10 @@ ossl_init_session_and_alpns(struct ossl_ctx *octx,
             bool do_early_data = FALSE;
             if(sess_reuse_cb) {
               result = sess_reuse_cb(cf, data, &alpns, scs, &do_early_data);
-              if(result)
+              if(result) {
+                SSL_SESSION_free(ssl_session);
                 return result;
+              }
             }
             if(do_early_data) {
               /* We only try the ALPN protocol the session used before,