diff -up openssl-1.0.1e/ssl/t1_lib.c.ticket-length openssl-1.0.1e/ssl/t1_lib.c

--- openssl-1.0.1e/ssl/t1_lib.c.ticket-length	2016-09-20 15:37:34.000000000 +0200

+++ openssl-1.0.1e/ssl/t1_lib.c	2016-09-20 18:09:26.057028290 +0200

@@ -2230,9 +2230,7 @@ static int tls_decrypt_ticket(SSL *s, co

 	HMAC_CTX hctx;

 	EVP_CIPHER_CTX ctx;

 	SSL_CTX *tctx = s->initial_ctx;

-	/* Need at least keyname + iv + some encrypted data */

-	if (eticklen < 48)

-		return 2;

+

 	/* Initialize session ticket encryption and HMAC contexts */

 	HMAC_CTX_init(&hctx);

 	EVP_CIPHER_CTX_init(&ctx;;

@@ -2267,6 +2265,14 @@ static int tls_decrypt_ticket(SSL *s, co

 		EVP_CIPHER_CTX_cleanup(&ctx;;

 		return -1;

 		}

+	/* Sanity check ticket length: must exceed keyname + IV + HMAC */

+	if (eticklen <= 16 + EVP_CIPHER_CTX_iv_length(&ctx) + mlen)

+		{

+		HMAC_CTX_cleanup(&hctx);

+		EVP_CIPHER_CTX_cleanup(&ctx;;

+		return 2;

+		}

+

 	eticklen -= mlen;

 	/* Check HMAC of encrypted ticket */

 	HMAC_Update(&hctx, etick, eticklen);