Fix null pointer dereference when memory allocation fails

[yangyangtiantianlonglong]

A null pointer dereference occurs when memory allocation fails
Fixes #21605

nit

[mspncp]

Side note: looking at the source code for 3.0

openssl/ssl/ssl_sess.c

Lines 820 to 826 in bbc1aa9

	void SSL_SESSION_free(SSL_SESSION *ss)
	{
	int i;
	if (ss == NULL)
	return;
	CRYPTO_DOWN_REF(&ss->references, &i, ss->lock);

and 3.1,

openssl/ssl/ssl_sess.c

Lines 822 to 828 in 162b5a3

	void SSL_SESSION_free(SSL_SESSION *ss)
	{
	int i;
	if (ss == NULL)
	return;
	CRYPTO_DOWN_REF(&ss->references, &i, ss->lock);

it seems like the fix needs to be applied to the 3.0 and 3.1 branches as well (and it cherry-picks cleanly). However, looking at @paulidale's commit 99fd5b2 it turns out not to be an issue because the lock parameter is ignored in CRYPTO_DOWN_REF().

[yangyangtiantianlonglong]

Side note: looking at the source code for 3.0

openssl/ssl/ssl_sess.c

Lines 820 to 826 in bbc1aa9

	void SSL_SESSION_free(SSL_SESSION *ss)
	{
	int i;
	if (ss == NULL)
	return;
	CRYPTO_DOWN_REF(&ss->references, &i, ss->lock);

and 3.1,

openssl/ssl/ssl_sess.c

Lines 822 to 828 in 162b5a3

	void SSL_SESSION_free(SSL_SESSION *ss)
	{
	int i;
	if (ss == NULL)
	return;
	CRYPTO_DOWN_REF(&ss->references, &i, ss->lock);

it seems like the fix needs to be applied to the 3.0 and 3.1 branches as well (and it cherry-picks cleanly). However, looking at @paulidale's commit 99fd5b2 it turns out not to be an issue because the lock parameter is ignored in CRYPTO_DOWN_REF().

yes，I only encountered this issue with GCC 4.1.1 and openssl-1.1.1.

[openssl-machine]

This pull request is ready to merge

[hlandau]

Merged to 1.1.1, 3.1 and 3.0. Does not appear to be applicable to master.