Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssl_build_cert_chain() may crash on NULL SSL argument #11690

Closed
DDvO opened this issue Apr 30, 2020 · 2 comments
Closed

ssl_build_cert_chain() may crash on NULL SSL argument #11690

DDvO opened this issue Apr 30, 2020 · 2 comments
Labels
issue: bug report The issue was opened to report a bug

Comments

@DDvO
Copy link
Contributor

DDvO commented Apr 30, 2020

The recently merged #11457 introduced in ssl/ssl_cert.c the call

    xs_ctx = X509_STORE_CTX_new_with_libctx(s->ctx->libctx, s->ctx->propq);

which crashes if s = NULL.
This happens for instance when called by ssl3_ctx_ctrl() in ssl/s3_lib.c as follows.

    return ssl_build_cert_chain(NULL, ctx, larg);
@DDvO DDvO added the issue: bug report The issue was opened to report a bug label Apr 30, 2020
@DDvO
Copy link
Contributor Author

DDvO commented Apr 30, 2020

Here is a backtrace I got while doing tests for #11470.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff74cc094 in ssl_build_cert_chain (s=0x0, ctx=0x61b000001580, flags=3) at ssl/ssl_cert.c:875
875	    xs_ctx = X509_STORE_CTX_new_with_libctx(s->ctx->libctx, s->ctx->propq);
(gdb) bt
#0  0x00007ffff74cc094 in ssl_build_cert_chain (s=0x0, ctx=0x61b000001580, flags=3) at ssl/ssl_cert.c:875
#1  0x00007ffff74be8eb in ssl3_ctx_ctrl (ctx=0x61b000001580, cmd=105, larg=3, parg=0x0) at ssl/s3_lib.c:3955
#2  0x00007ffff74e7fe9 in SSL_CTX_ctrl (ctx=0x61b000001580, cmd=105, larg=3, parg=0x0) at ssl/ssl_lib.c:2533
#3  0x0000000000437766 in setup_ssl_ctx (ctx=0x615000000d00, e=0x0) at apps/cmp.c:1813
#4  0x000000000043b2b1 in setup_client_ctx (ctx=0x615000000d00, e=0x0) at apps/cmp.c:2357
#5  0x000000000043fb5a in cmp_main (argc=3, argv=0x7fffffffdd10) at apps/cmp.c:3265
#6  0x0000000000469344 in do_cmd (prog=0x60f0000004f0, argc=3, argv=0x7fffffffdd10) at apps/openssl.c:490
#7  0x0000000000468593 in main (argc=3, argv=0x7fffffffdd10) at apps/openssl.c:302

@t8m
Copy link
Member

t8m commented Apr 30, 2020

This is already fixed by 64e54bf

@t8m t8m closed this as completed Apr 30, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
issue: bug report The issue was opened to report a bug
Projects
None yet
Development

No branches or pull requests

2 participants