segfault when using ALPN with mbedtls #642

bagder opened this Issue Feb 9, 2016 · 2 comments


None yet

2 participants

bagder commented Feb 9, 2016
$ uname -a
Linux 4.3.0-1-amd64 #1 SMP Debian 4.3.3-5 (2016-01-04) x86_64 GNU/Linux
$ ./src/curl -V
curl 7.47.2-DEV (x86_64-pc-linux-gnu) libcurl/7.47.2-DEV mbedTLS/2.2.1 [snip]
$ ./src/curl
Segmentation fault
$ ./src/curl --no-alpn > /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3023  100  3023    0     0  31118      0 --:--:-- --:--:-- --:--:-- 31489
@bagder bagder added the SSL/TLS label Feb 9, 2016
bagder commented Feb 9, 2016


const char *protocols[3];

This array is allocated on the stack, then passed to mbedtls_ssl_conf_alpn_protocols, but mbedtls doesn't clone the array, it stores the same pointer it gets and assumes that it can use it later, while libcurl doesn't keep that array around...

@bagder bagder added a commit that closed this issue Feb 9, 2016
@bagder bagder mbedtls: fix ALPN usage segfault
Since we didn't keep the input argument around after having called
mbedtls, it could end up accessing the wrong memory when figuring out
the ALPN protocols.

Closes #642
@bagder bagder closed this in 716302c Feb 9, 2016
jay commented Feb 10, 2016

Nice catch, I guess I've just been lucky it didn't crash on me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment