From d271efc353856df91d28c8f54ead56b298c852f0 Mon Sep 17 00:00:00 2001 From: Jakub Zelenka Date: Tue, 4 Aug 2026 18:00:37 +0200 Subject: [PATCH] statem: fix missing SSLfatal in TLSv1.3 ticket construction tls_construct_new_session_ticket() assumed ssl_session_dup() calls SSLfatal() on failure but it never does, unlike all its other call sites which call SSLfatal() themselves. An allocation failure there made the construct function return CON_FUNC_ERROR without entering the fatal state, tripping the check_fatal assertion in write_state_machine() on debug builds. Assisted-by: Claude:claude-fable-5 Reviewed-by: Matt Caswell Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Tomas Mraz MergeDate: Mon Aug 10 13:55:51 2026 (Merged from https://github.com/openssl/openssl/pull/32183) --- ssl/statem/statem_srvr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index 11b8df52ee8..ba201abc521 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -4545,7 +4545,7 @@ CON_FUNC_RETURN tls_construct_new_session_ticket(SSL_CONNECTION *s, WPACKET *pkt SSL_SESSION *new_sess = ssl_session_dup(s->session, 0); if (new_sess == NULL) { - /* SSLfatal already called */ + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB); goto err; } -- 2.47.3