diff -up openssl-1.0.1e/ssl/t1_lib.c.ticket-length openssl-1.0.1e/ssl/t1_lib.c
--- openssl-1.0.1e/ssl/t1_lib.c.ticket-length	2016-09-20 15:37:34.000000000 +0200
+++ openssl-1.0.1e/ssl/t1_lib.c	2016-09-20 18:09:26.057028290 +0200
@@ -2230,9 +2230,7 @@ static int tls_decrypt_ticket(SSL *s, co
 	HMAC_CTX hctx;
 	EVP_CIPHER_CTX ctx;
 	SSL_CTX *tctx = s->initial_ctx;
-	/* Need at least keyname + iv + some encrypted data */
-	if (eticklen < 48)
-		return 2;
+
 	/* Initialize session ticket encryption and HMAC contexts */
 	HMAC_CTX_init(&hctx);
 	EVP_CIPHER_CTX_init(&ctx);
@@ -2267,6 +2265,14 @@ static int tls_decrypt_ticket(SSL *s, co
 		EVP_CIPHER_CTX_cleanup(&ctx);
 		return -1;
 		}
+	/* Sanity check ticket length: must exceed keyname + IV + HMAC */
+	if (eticklen <= 16 + EVP_CIPHER_CTX_iv_length(&ctx) + mlen)
+		{
+		HMAC_CTX_cleanup(&hctx);
+		EVP_CIPHER_CTX_cleanup(&ctx);
+		return 2;
+		}
+
 	eticklen -= mlen;
 	/* Check HMAC of encrypted ticket */
 	HMAC_Update(&hctx, etick, eticklen);