andreacavalli/netty5
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Check if SSL pointer was freed before using it in RefereceCountedOpenSslEngine in all cases (#10299)

Browse Source 
Motivation:

To ensure we not crash in all cases we should better check that the SSL pointer was not freed before using it.

Modifications:

Add missing `isDestroyed()` checks

Result:

Ensure we not crash due usage of freed pointer.
This commit is contained in:
Norman Maurer 2020-05-18 09:40:31 +02:00
parent dc6ea0881c
commit 51805e3248
1 changed files with 25 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngine.java
View File

@ -1915,7 +1915,9 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
*/
@UnstableApi
public final synchronized void setVerify(int verifyMode, int depth) {
SSL.setVerify(ssl, verifyMode, depth);
if (!isDestroyed()) {
SSL.setVerify(ssl, verifyMode, depth);
}
}
private void setClientAuth(ClientAuth mode) {
@ -1927,18 +1929,20 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
// No need to issue any JNI calls if the mode is the same
return;
}
switch (mode) {
case NONE:
SSL.setVerify(ssl, SSL.SSL_CVERIFY_NONE, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
break;
case REQUIRE:
SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
break;
case OPTIONAL:
SSL.setVerify(ssl, SSL.SSL_CVERIFY_OPTIONAL, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
break;
default:
throw new Error(mode.toString());
if (!isDestroyed()) {
switch (mode) {
case NONE:
SSL.setVerify(ssl, SSL.SSL_CVERIFY_NONE, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
break;
case REQUIRE:
SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
break;
case OPTIONAL:
SSL.setVerify(ssl, SSL.SSL_CVERIFY_OPTIONAL, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
break;
default:
throw new Error(mode.toString());
}
}
clientAuth = mode;
}
@ -1987,8 +1991,9 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
throw new IllegalArgumentException("AlgorithmConstraints are not supported.");
}
boolean isDestroyed = isDestroyed();
if (version >= 8) {
if (!isDestroyed()) {
if (!isDestroyed) {
if (clientMode) {
final List<String> sniHostNames = Java8SslUtils.getSniHostNames(sslParameters);
for (String name: sniHostNames) {
@ -2006,14 +2011,13 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
}
final String endPointIdentificationAlgorithm = sslParameters.getEndpointIdentificationAlgorithm();
final boolean endPointVerificationEnabled = isEndPointVerificationEnabled(endPointIdentificationAlgorithm);
// If the user asks for hostname verification we must ensure we verify the peer.
// If the user disables hostname verification we leave it up to the user to change the mode manually.
if (clientMode && endPointVerificationEnabled) {
SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, -1);
if (!isDestroyed) {
// If the user asks for hostname verification we must ensure we verify the peer.
// If the user disables hostname verification we leave it up to the user to change the mode manually.
if (clientMode && isEndPointVerificationEnabled(endPointIdentificationAlgorithm)) {
SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, -1);
}
}
this.endPointIdentificationAlgorithm = endPointIdentificationAlgorithm;
algorithmConstraints = sslParameters.getAlgorithmConstraints();
}