1 files changed, 14 insertions, 20 deletions

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 80b45eb86f..398ce469d6 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -902,27 +902,21 @@ int ssl3_get_client_hello(SSL *s)
                                 break;
                                 }
                         }
-                if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
-                        {
-                        /* Special case as client bug workaround: the previously used cipher may
-                         * not be in the current list, the client instead might be trying to
-                         * continue using a cipher that before wasn't chosen due to server
-                         * preferences.  We'll have to reject the connection if the cipher is not
-                         * enabled, though. */
-                        c = sk_SSL_CIPHER_value(ciphers, 0);
-                        if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0)
-                                {
-                                s->session->cipher = c;
-                                j = 1;
-                                }
-                        }
                 if (j == 0)
                         {
-                        /* we need to have the cipher in the cipher
-                         * list if we are asked to reuse it */
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
-                        goto f_err;
+                        if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
+                                {
+                                /* Very bad for multi-threading.... */
+                                s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0);
+                                }
+                        else
+                                {
+                                /* we need to have the cipher in the cipher
+                                 * list if we are asked to reuse it */
+                                al=SSL_AD_ILLEGAL_PARAMETER;
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
+                                goto f_err;
+                                }
                         }
                 }
 
@@ -2566,7 +2560,7 @@ int ssl3_get_client_certificate(SSL *s)
         else
                 {
                 i=ssl_verify_cert_chain(s,sk);
-                if (i <= 0)
+                if (!i)
                         {
                         al=ssl_verify_alarm_type(s->verify_result);
                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);