ERL-148: httpc crashes if HTTPS request is answered with two ssl:send/2 calls

[OTP-Maintainer]

Original reporter: weisslj
Affected version: OTP-19.0
Fixed in version: OTP-19.0
Component: ssl
Migrated from: https://bugs.erlang.org/browse/ERL-148

---

With Erlang/OTP 19.0-rc1 {{httpc}} crashes when an HTTPS request is answered with two instead of one {{ssl:send/2}} calls.

A run of {{git bisect}} found commit [67de1ba|https://github.com/erlang/otp/commit/67de1ba82d1af910dc6ab6d41a1f22dbfb39f658] (ssl: Use gen_statem instead of gen_fsm) as responsible.

See also ERL-144 and ERL-147, might be related, but not sure.

I attached an example program:

h3. Usage

Terminal 1:
{noformat}
openssl req -x509 -newkey rsa -keyout key.pem -out cert.pem -nodes -subj '/CN=localhost'
escript test_server.escript
{noformat}

Terminal 2:
{noformat}
escript test_client.escript
{noformat}

h3. Output in terminal 2

With OTP 18:
{noformat}
Request successful, no bug
{noformat}

With OTP 19:
{noformat}
** Reason for termination == 
** {function_clause,
       [{httpc_handler,handle_info,
            [{error,closed},
[...]
Crash during request, *BUG*
{noformat}

[OTP-Maintainer]

ingela said:

There are some issues here. The thing is that tcp does not have a delivery guarantee on application level, only on tcp level. So if you put a sleep in your server before closing it down, the test will work. httpc could use some better errorhandling.  To avoid this you should use shutdown, but I got some problems in prim_inet  when trying that, I need to invesitigate it further.

[OTP-Maintainer]

ingela said:

Turns out there is a bug, even though your test is a bit timing dependent, fix is here.

{code:java}
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 208edc6..40f3eea 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -922,7 +922,7 @@ alert_user(Transport, Tracker, Socket,_, _, _, From, Alert, Role) ->
 alert_user(Transport, Tracker, Socket, From, Alert, Role) ->
     alert_user(Transport, Tracker, Socket, false, no_pid, From, Alert, Role).
 
-alert_user(_, _, _, false = Active, Pid, From,  Alert, Role) ->
+alert_user(_, _, _, false = Active, Pid, From,  Alert, Role) when From =/= undefined ->
     %% If there is an outstanding ssl_accept | recv
     %% From will be defined and send_or_reply will
     %% send the appropriate error message.

{code}

[OTP-Maintainer]

weisslj said:

Thank you for the quick fix, I can confirm it solves the problem!

[OTP-Maintainer]

weisslj said:

Fixing commit is [e63b071|https://github.com/erlang/otp/commit/e63b07167e3bcfc848ae6f0f08981d04fab991bc].