segfault when using ALPN with mbedtls #642

Closed
bagder opened this Issue Feb 9, 2016 · 2 comments

Projects

None yet

2 participants

@bagder
Member
bagder commented Feb 9, 2016
$ uname -a
Linux storebror.haxx.se 4.3.0-1-amd64 #1 SMP Debian 4.3.3-5 (2016-01-04) x86_64 GNU/Linux
$ ./src/curl -V
curl 7.47.2-DEV (x86_64-pc-linux-gnu) libcurl/7.47.2-DEV mbedTLS/2.2.1 [snip]
$ ./src/curl https://curl.haxx.se/
Segmentation fault
$ ./src/curl --no-alpn https://curl.haxx.se/ > /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3023  100  3023    0     0  31118      0 --:--:-- --:--:-- --:--:-- 31489
@bagder bagder added the SSL/TLS label Feb 9, 2016
@bagder
Member
bagder commented Feb 9, 2016

On https://github.com/curl/curl/blob/master/lib/vtls/mbedtls.c#L387

const char *protocols[3];

This array is allocated on the stack, then passed to mbedtls_ssl_conf_alpn_protocols, but mbedtls doesn't clone the array, it stores the same pointer it gets and assumes that it can use it later, while libcurl doesn't keep that array around...

@bagder bagder added a commit that closed this issue Feb 9, 2016
@bagder bagder mbedtls: fix ALPN usage segfault
Since we didn't keep the input argument around after having called
mbedtls, it could end up accessing the wrong memory when figuring out
the ALPN protocols.

Closes #642
716302c
@bagder bagder closed this in 716302c Feb 9, 2016
@jay
Member
jay commented Feb 10, 2016

Nice catch, I guess I've just been lucky it didn't crash on me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment