Fix configuring the empty cipher list.
Although it returns failure, the cipher list should still be updated.
Conscrypt relies on this behavior to support a Java API edge case.
Change-Id: If58efafc6a4a81e85a0e2ee2c38873a7a4938123
Reviewed-on: https://boringssl-review.googlesource.com/14165
Reviewed-by: Kenny Root <kroot@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/ssl/ssl_cipher.c b/ssl/ssl_cipher.c
index dc9cc2a..4ee3c12 100644
--- a/ssl/ssl_cipher.c
+++ b/ssl/ssl_cipher.c
@@ -1377,11 +1377,6 @@
OPENSSL_free(co_list); /* Not needed any longer */
co_list = NULL;
- if (sk_SSL_CIPHER_num(cipherstack) == 0) {
- OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CIPHER_MATCH);
- goto err;
- }
-
pref_list = OPENSSL_malloc(sizeof(struct ssl_cipher_preference_list_st));
if (!pref_list) {
goto err;
@@ -1400,6 +1395,13 @@
*out_cipher_list = pref_list;
pref_list = NULL;
+ /* Configuring an empty cipher list is an error but still updates the
+ * output. */
+ if (sk_SSL_CIPHER_num((*out_cipher_list)->ciphers) == 0) {
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CIPHER_MATCH);
+ return 0;
+ }
+
return 1;
err:
