Skip to content

Commit c7c68a0

Browse files
committed
net/ssl-bear: NULL-check calloc in ssl_socket_init
ssl_socket_init calloc'd its ssl_state struct but dereferenced it immediately on the next line: struct ssl_state *state = (struct ssl_state*)calloc(1, sizeof(*state)); initialize(); br_ssl_client_init_full(&state->sc, &state->xc, TAs, TAs_NUM); On OOM, &state->sc segfaults before the br_ssl_client_init_full call can even begin. Fix: NULL-check after calloc and return NULL on failure. The caller (net_http.c line 1030: if (!(conn->ssl_ctx = ssl_socket_init(conn->fd, ...))) ... ) already treats a NULL return as 'SSL setup failed, abort the connection', so returning NULL on OOM integrates cleanly. The sibling at net_socket_ssl_mbed.c:96 has the same bug and will be addressed in a follow-up. Thread-safety: unchanged. ssl_socket_init is called once per HTTPS connection from whichever thread is servicing that connection's http_t state.
1 parent e8ebb28 commit c7c68a0

1 file changed

Lines changed: 7 additions & 0 deletions

File tree

libretro-common/net/net_socket_ssl_bear.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,13 @@ void* ssl_socket_init(int fd, const char *domain)
233233
{
234234
struct ssl_state *state = (struct ssl_state*)calloc(1, sizeof(*state));
235235

236+
/* NULL-check before any of the br_ssl_* calls below dereference
237+
* state. The pre-patch form segfaulted on OOM at the first
238+
* br_ssl_client_init_full(&state->sc, ...) call. Caller
239+
* (net_http.c line 1030) already NULL-checks our return. */
240+
if (!state)
241+
return NULL;
242+
236243
initialize();
237244

238245
br_ssl_client_init_full(&state->sc, &state->xc, TAs, TAs_NUM);

0 commit comments

Comments
 (0)