[FD] OpenSSL 1.1.0 remote client memory corruption

Triggering this requires that the client sets a very large ALPN list (several thousand bytes). This would be very unusual in a real-world application. For this reason OpenSSL does not treat this as a security vulnerability and I am inclined to agree with this decision. However, if an attacker can

[FD] New OpenSSL double-free and invalid free vulnerabilities in X509 parsing

These vulnerabilities were found in the latest OpenSSL (1.1.0b). Triggering these vulnerabilities is not trivial -- they rely on memory shortages (malloc/realloc failures) or failing to acquire a thread lock while the X509 data is being parsed. Possibly exploitation can be achieved by exploiting a