commit 0982ecaaee78a106c5db440317b0a8a9c0022bed
author Viktor Dukhovni <openssl-users@dukhovni.org> Sat Jan 16 12:57:24 2016 -0500
committer Viktor Dukhovni <openssl-users@dukhovni.org> Sat Jan 16 17:15:28 2016 -0500
tree 4b7d030b691436c4b6d9ad0715e08d46549be6bd
parent ecdd0ff733985fb573d687fe85fa533f62f6cfd8

Empty SNI names are not valid

While empty inputs to SSL_set1_host() clear the reference identifier
list.

Reviewed-by: Rich Salz <rsalz@openssl.org>

ssl/s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index de8dae2..54b8eba 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3534,13 +3534,16 @@
 #endif                          /* !OPENSSL_NO_EC */
     case SSL_CTRL_SET_TLSEXT_HOSTNAME:
         if (larg == TLSEXT_NAMETYPE_host_name) {
+            size_t len;
+
             OPENSSL_free(s->tlsext_hostname);
             s->tlsext_hostname = NULL;
 
             ret = 1;
             if (parg == NULL)
                 break;
-            if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name) {
+            len = strlen((char *)parg);
+            if (len == 0 || len > TLSEXT_MAXLEN_host_name) {
                 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
                 return 0;
             }