OpenSslSession#initPeerCerts creates too long almost empty arrays

[ichaki5748]

netty 4.1.6

io.netty.handler.ssl.ReferenceCountedOpenSslEngine.OpenSslSession#initPeerCerts

final byte[] clientCert;
...
int len = clientCert.length + 1; // <------ BUG: raw certificate byte array size is used
peerCerts = new Certificate[len];
x509PeerCerts = new X509Certificate[len];

But should probably be

int len = chain.length + 1; // <------ so we have first entry as client cert + chain.length

[normanmaurer]

Maybe want to provide a PR with a fix?

Am 26.10.2016 um 21:25 schrieb ichaki5748 notifications@github.com:

netty 4.1.6

io.netty.handler.ssl.ReferenceCountedOpenSslEngine.OpenSslSession#initPeerCerts

final byte[] clientCert;
...
int len = clientCert.length + 1; // <------ BUG: raw certificate byte array size is used
peerCerts = new Certificate[len];
x509PeerCerts = new X509Certificate[len];

But should probably be

int len = chain.length + 1; // <------ so we have first entry as client cert + chain.length

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[ichaki5748]

Yes, sure, will try to do it this week

[normanmaurer]

Thx

Am 26.10.2016 um 23:54 schrieb ichaki5748 notifications@github.com:

Yes, sure, will try to do it this week

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[ichaki5748]

Also io.netty.handler.ssl.OpenSslJavaxX509Certificate.*
could theoretically blow in concurrent usage because of lazy init in io.netty.handler.ssl.OpenSslJavaxX509Certificate#unwrap because
io.netty.handler.ssl.OpenSslJavaxX509Certificate#wrapped is not volatile (certificate would not be fully initialized)?

[normanmaurer]

@iainmcgin please open separate PRs for the separate issues and ping me once you are ready. I will review then

[iainmcgin]

You probably meant to reference @ichaki5748

[normanmaurer]

@iainmcgin ups yes... sorry I need more ☕️

[ichaki5748]

@normanmaurer Hi, please see #5967 #5966

[normanmaurer]

Fixed by #5967