Skip to content

os400sys: protect shared global buffers when TLS key creation failed - #18967

Closed
MegaManSec wants to merge 1 commit into
curl:masterfrom
MegaManSec:os
Closed

os400sys: protect shared global buffers when TLS key creation failed#18967
MegaManSec wants to merge 1 commit into
curl:masterfrom
MegaManSec:os

Conversation

@MegaManSec

Copy link
Copy Markdown
Contributor

buffer_undef may set Curl_thread_buffer = buffer_unthreaded. This avoids concurrent realloc()/write races across threads.

buffer_undef may set Curl_thread_buffer = buffer_unthreaded.
This avoids concurrent realloc()/write races across threads.
@github-actions github-actions Bot added the build label Oct 9, 2025
@bagder

bagder commented Oct 9, 2025

Copy link
Copy Markdown
Member

/cc @monnerat

@monnerat

monnerat commented Oct 9, 2025

Copy link
Copy Markdown
Contributor

I dont think it is TLS-related (which TLS nowadays ???). Probably the title should say thread key instead of TLS.

That said, the current behavior is intentional: OS400 interactive jobs do not support threads, so we consider that, if the key creation fails, other thread-related calls will too, and so the mutex lock/unlock calls do.

In all cases, using an unthreaded buffer is not compatible with running threads and, should it occur, will likely fail even with this commit... but this situation would be paradoxal.

In the case of batch jobs, threads are available and thus the key creation succeeds (why would it fail?) and buffer_unthreaded is never called.

I would rather comment the thing in the code...

@bagder

bagder commented Oct 9, 2025

Copy link
Copy Markdown
Member

I would rather comment the thing in the code...

Do you maybe feel the urge to make a proposal? 😀

monnerat added a commit to monnerat/curl that referenced this pull request Oct 10, 2025
This is to clarify handling of threads unavaibility check and handling
for security bug busters unaware of OS400 specificities.

Closes curl#18967
monnerat added a commit to monnerat/curl that referenced this pull request Oct 10, 2025
This is to clarify threads unavaibility check and handling for security
bug busters unaware of OS400 specificities.

Closes curl#18967
@bagder bagder closed this in 67c75b6 Oct 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

3 participants