void ssl_session_free( ssl_session *session )
{
    if( session->peer_cert != NULL )
    {
        x509_free( session->peer_cert );
        free( session->peer_cert );
    }

    memset( session, 0, sizeof( ssl_session ) );
}

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.