New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

segfault when using ALPN with mbedtls #642

Closed
bagder opened this Issue Feb 9, 2016 · 2 comments

Comments

Projects
None yet
2 participants
@bagder
Member

bagder commented Feb 9, 2016

$ uname -a
Linux storebror.haxx.se 4.3.0-1-amd64 #1 SMP Debian 4.3.3-5 (2016-01-04) x86_64 GNU/Linux
$ ./src/curl -V
curl 7.47.2-DEV (x86_64-pc-linux-gnu) libcurl/7.47.2-DEV mbedTLS/2.2.1 [snip]
$ ./src/curl https://curl.haxx.se/
Segmentation fault
$ ./src/curl --no-alpn https://curl.haxx.se/ > /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3023  100  3023    0     0  31118      0 --:--:-- --:--:-- --:--:-- 31489

@bagder bagder added the SSL/TLS label Feb 9, 2016

@bagder

This comment has been minimized.

Show comment
Hide comment
@bagder

bagder Feb 9, 2016

Member

On https://github.com/curl/curl/blob/master/lib/vtls/mbedtls.c#L387

const char *protocols[3];

This array is allocated on the stack, then passed to mbedtls_ssl_conf_alpn_protocols, but mbedtls doesn't clone the array, it stores the same pointer it gets and assumes that it can use it later, while libcurl doesn't keep that array around...

Member

bagder commented Feb 9, 2016

On https://github.com/curl/curl/blob/master/lib/vtls/mbedtls.c#L387

const char *protocols[3];

This array is allocated on the stack, then passed to mbedtls_ssl_conf_alpn_protocols, but mbedtls doesn't clone the array, it stores the same pointer it gets and assumes that it can use it later, while libcurl doesn't keep that array around...

@jay

This comment has been minimized.

Show comment
Hide comment
@jay

jay Feb 10, 2016

Member

Nice catch, I guess I've just been lucky it didn't crash on me.

Member

jay commented Feb 10, 2016

Nice catch, I guess I've just been lucky it didn't crash on me.

@lock lock bot locked as resolved and limited conversation to collaborators May 7, 2018

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.