Ensure that we do not process a ChangeCipherSpec with an empty master
secret. This is an additional safeguard against early ChangeCipherSpec
handling.

From OpenSSL.

ok deraadt@