Lets take a look at the vulnerable code:
if (s->servername_done == 0) {
switch (servname_type) {
case TLSEXT_NAMETYPE_host_name:
if (s->session->tlsext_hostname == NULL) {
if (len > TLSEXT_MAXLEN_host_name ||
((s->session->tlsext_hostname = OPENSSL_malloc(len + 1)) == NULL)) {
*al = TLS1_AD_UNRECOGNIZED_NAME;