Commit c7c68a0
committed
net/ssl-bear: NULL-check calloc in ssl_socket_init
ssl_socket_init calloc'd its ssl_state struct but dereferenced it
immediately on the next line:
struct ssl_state *state = (struct ssl_state*)calloc(1, sizeof(*state));
initialize();
br_ssl_client_init_full(&state->sc, &state->xc, TAs, TAs_NUM);
On OOM, &state->sc segfaults before the br_ssl_client_init_full
call can even begin.
Fix: NULL-check after calloc and return NULL on failure. The
caller (net_http.c line 1030:
if (!(conn->ssl_ctx = ssl_socket_init(conn->fd, ...)))
...
) already treats a NULL return as 'SSL setup failed, abort the
connection', so returning NULL on OOM integrates cleanly.
The sibling at net_socket_ssl_mbed.c:96 has the same bug and will
be addressed in a follow-up.
Thread-safety: unchanged. ssl_socket_init is called once per
HTTPS connection from whichever thread is servicing that
connection's http_t state.1 parent e8ebb28 commit c7c68a0
1 file changed
Lines changed: 7 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
233 | 233 | | |
234 | 234 | | |
235 | 235 | | |
| 236 | + | |
| 237 | + | |
| 238 | + | |
| 239 | + | |
| 240 | + | |
| 241 | + | |
| 242 | + | |
236 | 243 | | |
237 | 244 | | |
238 | 245 | | |
| |||
0 commit comments