segfault when using ALPN with mbedtls

[bagder]

$ uname -a
Linux storebror.haxx.se 4.3.0-1-amd64 #1 SMP Debian 4.3.3-5 (2016-01-04) x86_64 GNU/Linux
$ ./src/curl -V
curl 7.47.2-DEV (x86_64-pc-linux-gnu) libcurl/7.47.2-DEV mbedTLS/2.2.1 [snip]
$ ./src/curl https://curl.haxx.se/
Segmentation fault
$ ./src/curl --no-alpn https://curl.haxx.se/ > /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3023  100  3023    0     0  31118      0 --:--:-- --:--:-- --:--:-- 31489

[bagder]

On https://github.com/curl/curl/blob/master/lib/vtls/mbedtls.c#L387

const char *protocols[3];

This array is allocated on the stack, then passed to mbedtls_ssl_conf_alpn_protocols, but mbedtls doesn't clone the array, it stores the same pointer it gets and assumes that it can use it later, while libcurl doesn't keep that array around...

[jay]

Nice catch, I guess I've just been lucky it didn't crash on me.