View Issue Details

IDProjectCategoryView StatusLast Update
0000583LDMud 3.3Otherpublic2018-01-29 22:57
Reporterwillem Assigned ToGnomi  
PrioritynormalSeveritycrashReproducibilitysometimes
Status resolvedResolutionfixed 
Fixed in Version3.3.719 
Summary0000583: TLS: context->client_CA free()'d while still in use
DescriptionIf using OpenSSL, and the driver is invoked without --tls-trustfile, "context->client_CA" is freed, and the memory gets overwritten with other data. On one of my machines, "context->client_CA->num" always gets overwritten with 0x0, so it thinks it has no certificates, but doesn't crash. On another machine the value is instead a large integer. This produces a SIGSEGV when attempting to dereference "context->client_CA->data" which also contains garbage.

The problem occurs because SSL_CTX_set_client_CA_list() doesn't check to see if "context->client_CA" and "stack" are already the same. This is the case when no trustfile is specified. It will free "context->client_CA" immediately if it is not NULL, and replace it with "stack" (the same value, and a bad pointer).

Below is an untested patch that might fix the problem.
Additional Information--- pkg-tls.c 2008-08-11 08:28:52.000000000 +0700
+++ pkg-tls.c 2008-11-24 01:43:35.000000000 +0700
@@ -389,6 +389,7 @@
     if (trustfile != NULL)
     {
        stack = SSL_load_client_CA_file(trustfile);
+ SSL_CTX_set_client_CA_list(context, stack);
     }
     else
     {
@@ -398,11 +399,6 @@
     {
        SSL_add_dir_cert_subjects_to_stack(stack, trustdirectory);
     }
-
- if (stack != NULL)
- {
- SSL_CTX_set_client_CA_list(context, stack);
- }
 }
 #endif

TagsNo tags attached.

Relationships

has duplicate 0000677 resolvedzesstra LDMud 3.2 starting an SSL-secured connection crashes the driver 

Activities

Gnomi

2009-04-12 14:03

manager   ~0001020

Fixed in r2543.

Issue History

Date Modified Username Field Change
2008-11-23 14:27 willem New Issue
2008-12-26 18:34 Gnomi Status new => assigned
2008-12-26 18:34 Gnomi Assigned To => Gnomi
2009-04-12 14:03 Gnomi Note Added: 0001020
2009-04-12 14:03 Gnomi Status assigned => resolved
2009-04-12 14:03 Gnomi Fixed in Version => 3.3.719
2009-04-12 14:03 Gnomi Resolution open => fixed
2009-04-14 14:12 zesstra Project LDMud => LDMud 3.3
2009-10-05 16:36 zesstra Relationship added has duplicate 0000677
2010-11-16 10:42 Gnomi Source_changeset_attached => ldmud.git master d7fa87e2
2018-01-29 19:59 Gnomi Source_changeset_attached => ldmud.git master d7fa87e2
2018-01-29 22:57 Gnomi Source_changeset_attached => ldmud.git master d7fa87e2