dispose state when AEAD decryption fails, otherwise `ptls_is_ech_handshake` returns true
diff --git a/lib/picotls.c b/lib/picotls.c
index 2d2ab7d..899490e 100644
--- a/lib/picotls.c
+++ b/lib/picotls.c
@@ -4161,6 +4161,10 @@
goto Exit;
if (!is_second_flight)
memcpy(tls->client_random.inner, ch->random_bytes, PTLS_HELLO_RANDOM_SIZE);
+ } else {
+ /* decryption failure indicates key mismatch; dispose of AEAD context to indicate that outerCH is adopted */
+ ptls_aead_free(tls->server.ech.aead);
+ tls->server.ech.aead = NULL;
}
}
} else if (tls->server.ech.offered_by_client) {
