From a182a93c1a1bca28bb00fed4bb8d47996249d6d2 Mon Sep 17 00:00:00 2001
From: alesapin <alesapin@gmail.com>
Date: Fri, 9 Oct 2020 11:56:50 +0300
Subject: [PATCH] Fix race on session dup

---
 ssl/ssl_sess.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 941660d8a12da..79b9158ad33e1 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -111,7 +111,15 @@ SSL_SESSION *ssl_session_dup(const SSL_SESSION *src, int ticket)
     if (dest == NULL) {
         goto err;
     }
-    memcpy(dest, src, sizeof(*dest));
+
+    /*
+     * Copy until prev ptr, because it's a part of sessons cache which can be modified
+     * concurrently. Other fields filled in the code bellow.
+     */
+    memcpy(dest, src, offsetof(SSL_SESSION, prev));
+    dest->ext = src->ext;
+    dest->ticket_appdata_len = src->ticket_appdata_len;
+    dest->flags = src->flags;
 
     /*
      * Set the various pointers to NULL so that we can call SSL_SESSION_free in