From b749dda5205f1b01aeee03c5874acae7c543f0c5 Mon Sep 17 00:00:00 2001
From: Jon Siwek <jsiwek@corelight.com>
Date: Wed, 6 May 2020 09:48:37 -0700
Subject: [PATCH] Fix SSL scripting error leading to access of unitialized
 field

Reported by Justin Azoff
---
 scripts/base/protocols/ssl/main.zeek | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/base/protocols/ssl/main.zeek b/scripts/base/protocols/ssl/main.zeek
index 2c5e5d796b..01b5309c1a 100644
--- a/scripts/base/protocols/ssl/main.zeek
+++ b/scripts/base/protocols/ssl/main.zeek
@@ -315,12 +315,12 @@ event ssl_alert(c: connection, is_orig: bool, level: count, desc: count) &priori
 
 event ssl_established(c: connection) &priority=7
 	{
-	set_session(c);
 	c$ssl$established = T;
 	}
 
 event ssl_established(c: connection) &priority=20
 	{
+	set_session(c);
 	hook ssl_finishing(c);
 	}