diff options
author | Matt Caswell <matt@openssl.org> | 2020-06-16 17:40:40 +0100 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2020-06-23 12:46:47 +0100 |
commit | 7cccecc0b64e8c273c36a69eab22d942d12209a1 (patch) | |
tree | 4292d0f16bb145c23a20c44733208a1b7736b476 /ssl | |
parent | 457751fb48d8f6c31f32cdc1bcfcc376db98bacb (diff) |
Don't attempt to duplicate the BIO state in SSL_dup
SSL_dup attempted to duplicate the BIO state if the source SSL had BIOs
configured for it. This did not work.
Firstly the SSL_dup code was passing a BIO ** as the destination
argument for BIO_dup_state. However BIO_dup_state expects a BIO * for that
parameter. Any attempt to use this will either (1) fail silently, (2) crash
or fail in some other strange way.
Secondly many BIOs do not implement the BIO_CTRL_DUP ctrl required to make
this work.
Thirdly, if rbio == wbio in the original SSL object, then an attempt is made
to up-ref the BIO in the new SSL object - even though it hasn't been set
yet and is NULL. This results in a crash.
This appears to have been broken for a very long time with at least some of
the problems described above coming from SSLeay. The simplest approach is
to just remove this capability from the function.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12180)
Diffstat (limited to 'ssl')
-rw-r--r-- | ssl/ssl_lib.c | 15 |
1 files changed, 0 insertions, 15 deletions
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index f7544ab402..fea040289b 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -4023,21 +4023,6 @@ SSL *SSL_dup(SSL *s) if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data)) goto err; - /* setup rbio, and wbio */ - if (s->rbio != NULL) { - if (!BIO_dup_state(s->rbio, (char *)&ret->rbio)) - goto err; - } - if (s->wbio != NULL) { - if (s->wbio != s->rbio) { - if (!BIO_dup_state(s->wbio, (char *)&ret->wbio)) - goto err; - } else { - BIO_up_ref(ret->rbio); - ret->wbio = ret->rbio; - } - } - ret->server = s->server; if (s->handshake_func) { if (s->server) |