andreacavalli/netty5
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Check if SSL pointer was freed before using it in RefereceCountedOpenSslEngine in all cases (#10299)

Browse Source 
Motivation:

To ensure we not crash in all cases we should better check that the SSL pointer was not freed before using it.

Modifications:

Add missing `isDestroyed()` checks

Result:

Ensure we not crash due usage of freed pointer.
This commit is contained in:
Norman Maurer 2020-05-18 09:40:31 +02:00
parent dc6ea0881c
commit 51805e3248
1 changed files with 25 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngine.java
View File

@ -1915,7 +1915,9 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
*/ */
@UnstableApi @UnstableApi
public final synchronized void setVerify(int verifyMode, int depth) { public final synchronized void setVerify(int verifyMode, int depth) {
SSL.setVerify(ssl, verifyMode, depth); if (!isDestroyed()) {
SSL.setVerify(ssl, verifyMode, depth);
}
} }
private void setClientAuth(ClientAuth mode) { private void setClientAuth(ClientAuth mode) {
@ -1927,18 +1929,20 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
// No need to issue any JNI calls if the mode is the same // No need to issue any JNI calls if the mode is the same
return; return;
} }
switch (mode) { if (!isDestroyed()) {
case NONE: switch (mode) {
SSL.setVerify(ssl, SSL.SSL_CVERIFY_NONE, ReferenceCountedOpenSslContext.VERIFY_DEPTH); case NONE:
break; SSL.setVerify(ssl, SSL.SSL_CVERIFY_NONE, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
case REQUIRE: break;
SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, ReferenceCountedOpenSslContext.VERIFY_DEPTH); case REQUIRE:
break; SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
case OPTIONAL: break;
SSL.setVerify(ssl, SSL.SSL_CVERIFY_OPTIONAL, ReferenceCountedOpenSslContext.VERIFY_DEPTH); case OPTIONAL:
break; SSL.setVerify(ssl, SSL.SSL_CVERIFY_OPTIONAL, ReferenceCountedOpenSslContext.VERIFY_DEPTH);
default: break;
throw new Error(mode.toString()); default:
throw new Error(mode.toString());
}
} }
clientAuth = mode; clientAuth = mode;
} }
@ -1987,8 +1991,9 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
throw new IllegalArgumentException("AlgorithmConstraints are not supported."); throw new IllegalArgumentException("AlgorithmConstraints are not supported.");
} }
boolean isDestroyed = isDestroyed();
if (version >= 8) { if (version >= 8) {
if (!isDestroyed()) { if (!isDestroyed) {
if (clientMode) { if (clientMode) {
final List<String> sniHostNames = Java8SslUtils.getSniHostNames(sslParameters); final List<String> sniHostNames = Java8SslUtils.getSniHostNames(sslParameters);
for (String name: sniHostNames) { for (String name: sniHostNames) {
@ -2006,14 +2011,13 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
} }
final String endPointIdentificationAlgorithm = sslParameters.getEndpointIdentificationAlgorithm(); final String endPointIdentificationAlgorithm = sslParameters.getEndpointIdentificationAlgorithm();
final boolean endPointVerificationEnabled = isEndPointVerificationEnabled(endPointIdentificationAlgorithm); if (!isDestroyed) {
// If the user asks for hostname verification we must ensure we verify the peer.
// If the user asks for hostname verification we must ensure we verify the peer. // If the user disables hostname verification we leave it up to the user to change the mode manually.
// If the user disables hostname verification we leave it up to the user to change the mode manually. if (clientMode && isEndPointVerificationEnabled(endPointIdentificationAlgorithm)) {
if (clientMode && endPointVerificationEnabled) { SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, -1);
SSL.setVerify(ssl, SSL.SSL_CVERIFY_REQUIRED, -1); }
} }
this.endPointIdentificationAlgorithm = endPointIdentificationAlgorithm; this.endPointIdentificationAlgorithm = endPointIdentificationAlgorithm;
algorithmConstraints = sslParameters.getAlgorithmConstraints(); algorithmConstraints = sslParameters.getAlgorithmConstraints();
} }