[System.Security] Fix CryptographicException from ProtectedData.Protect with multiple threads #2702
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ct with multiple threads The code in ManagedProtection.GetKey() instantiated a new RSACryptoServiceProvider singleton without proper locking to avoid multiple threads running the initialization concurrently. Since RSACryptoServiceProvider (or rather KeyPairPersistence underneath) uses an XML file with a name derived from the parameters to store the data there could be a case where one thread writes while another tries to read and gets garbage. This results in a CryptographicException later on. Added locking to prevent this. Fixes https://bugzilla.xamarin.com/show_bug.cgi?id=38933
tritao
added a commit
that referenced
this pull request
Mar 1, 2016
[System.Security] Fix CryptographicException from ProtectedData.Protect with multiple threads
| CspParameters csp = new CspParameters (); | ||
| csp.KeyContainerName = "DAPI"; | ||
| user = new RSACryptoServiceProvider (1536, csp); | ||
| lock (user_lock) { |
There was a problem hiding this comment.
Shouldn't you double check if user == null whichin the lock?
There was a problem hiding this comment.
Yes, but it doesn't really matter in this case since in the worst case we just create another object with the same parameters. I can add it if you prefer following the double-check pattern.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The code in ManagedProtection.GetKey() instantiated a new RSACryptoServiceProvider singleton without proper locking to avoid multiple threads running the initialization concurrently.
Since RSACryptoServiceProvider (or rather KeyPairPersistence underneath) uses an XML file with a name derived from the parameters to store the data there could be a case where one thread writes while another tries to read and gets garbage. This results in a CryptographicException later on.
Added locking to prevent this.
Fixes https://bugzilla.xamarin.com/show_bug.cgi?id=38933