Bugs item #2905220, was opened at 2009-11-27 20:51
Message generated for change (Tracker Item Submitted) made by csapuntz
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=2905220&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: SSL/TLS
Group: crash
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Constantine Sapuntzakis (csapuntz)
Assigned to: Daniel Stenberg (bagder)
Summary: multi + OpenSSL use after free - memory

Initial Comment:
curl_multi_cleanup calls curl_rm_connc eventually which calls conn_free which calls Curl_ossl_close which calls ssl3_shutdown.

ssl3_shutdown fails to send an alert packet (e.g. because the conn timed out) and then logs a message. This calls back into curl ssl_tls_trace. It tries
to use conn->data. But conn->data points to some long gone easy handle (I think). Use after free.

Index: url.c
===================================================================
--- url.c (revision 33084)
+++ url.c (working copy)
@@ -2825,6 +2825,7 @@
 ConnectionDone(struct connectdata *conn)
 {
   conn->inuse = FALSE;
+ conn->data = NULL;
 }
 
 /*

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=2905220&group_id=976
Received on 2009-11-28