Segfault in 1.0.1j BIO_reset() compiled with no-ssl2 no-ssl3

[Frank Schmirler]

Hi,

I get the following segfault when trying to send an SSLv3 request to the
reverse proxy "pound", running on openssl-1.0.1j with SSLv2/3 disabled:

Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 14548]
0xb77498fa in ssl_ctrl (b=0xb7001010, cmd=1, num=0, ptr=0x0) at bio_ssl.c:312
312 if (ssl->handshake_func == ssl->method->ssl_connect)
(gdb) bt
#0 0xb77498fa in ssl_ctrl (b=0xb7001010, cmd=1, num=0, ptr=0x0)
at bio_ssl.c:312
#1 0xb75f8bf2 in BIO_ctrl (b=0xb7001010, cmd=1, larg=0, parg=0x0)
at bio_lib.c:370
#2 0x0804e942 in do_http (arg=0x807ced0) at http.c:656
#3 0x080538d6 in thr_http_single (dummy=0x807ced0) at http.c:1793
#4 0xb74ee99b in ?? () from /lib/libpthread.so.0
#5 0xb745747e in clone () from /lib/libc.so.6

The problem is that ssl->method is NULL:
(gdb) printf "%p\n", ((SSL*) ((BIO_SSL *)b->ptr)->ssl)->method
(nil)

The segfault does not occur if I additionally disable SSLv2/3 in the application:
SSL_CTX_set_options(p->ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);

For your reference, here's the corresponding application code. Segfault occurs
in BIO_reset() on line 641 (I'm using some patches, so line numbering from my
backtrace is slightly off):
https://github.com/goochjj/pound/blob/stage_for_upstream/v2.7b/http.c#L641

Maybe someone could take a look...

Thanks,
Frank
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users-MCmKBN63+***@public.gmane.org
Automated List Manager majordomo-MCmKBN63+***@public.gmane.org

[Frank Schmirler]

Post by Frank Schmirler
I get the following segfault when trying to send an SSLv3 request to
Program received signal SIGSEGV, Segmentation fault.
0xb77498fa in ssl_ctrl (b=0xb7001010, cmd=1, num=0, ptr=0x0) at bio_ssl.c:312
312 if (ssl->handshake_func == ssl->method->ssl_connect)

Problem is that ssl23_get_server_method(SSL3_VERSION) returns NULL when
compiled with "no-ssl3", setting ssl->method to NULL. The attached patch adds
a define to ssl23_get_client_hello(...) to treat the "no-ssl3" just like the
"SSL_OP_NO_SSLv3" flag.

Regards,
Frank

[Jeffrey Walton]

Post by Frank Schmirler

Post by Frank Schmirler
I get the following segfault when trying to send an SSLv3 request to
Program received signal SIGSEGV, Segmentation fault.
0xb77498fa in ssl_ctrl (b=0xb7001010, cmd=1, num=0, ptr=0x0) at bio_ssl.c:312
312 if (ssl->handshake_func == ssl->method->ssl_connect)

Problem is that ssl23_get_server_method(SSL3_VERSION) returns NULL when
compiled with "no-ssl3", setting ssl->method to NULL. The attached patch adds
a define to ssl23_get_client_hello(...) to treat the "no-ssl3" just like the
"SSL_OP_NO_SSLv3" flag.

Well, shooting from the hip.... If OpenSSL was configured with
no-ssl3, then the following will be defined in <opensslconf.h>:

OPENSSL_NO_SSL3

So you might want to OR-in the flag only if OPENSSL_NO_SSL3 is
defined. And treat the NULL return as an error otherwise.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users-MCmKBN63+***@public.gmane.org
Automated List Manager majordomo-MCmKBN63+***@public.gmane.org