GeezerVison is showing github.com — tls: fix segfault on destroy after partial read · nodejs/node@d0868ff
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: src/tls_wrap.cc +6Lines changed: 6 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -426,6 +426,12 @@ void TLSWrap::ClearOut() { |
426 | 426 | memcpy(buf.base, current, avail); |
427 | 427 | OnRead(avail, &buf); |
428 | 428 |
|
| 429 | + // Caveat emptor: OnRead() calls into JS land which can result in |
| 430 | + // the SSL context object being destroyed. We have to carefully |
| 431 | + // check that ssl_ != nullptr afterwards. |
| 432 | + if (ssl_ == nullptr) |
| 433 | + return; |
| 434 | + |
429 | 435 | read -= avail; |
430 | 436 | current += avail; |
431 | 437 | } |
|
Collapse file
Copy file name to clipboard +36Lines changed: 36 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
| 1 | +'use strict'; |
| 2 | + |
| 3 | +const common = require('../common'); |
| 4 | + |
| 5 | +if (!common.hasCrypto) { |
| 6 | + common.skip('missing crypto'); |
| 7 | + return; |
| 8 | +} |
| 9 | + |
| 10 | +const fs = require('fs'); |
| 11 | +const net = require('net'); |
| 12 | +const tls = require('tls'); |
| 13 | + |
| 14 | +const key = fs.readFileSync(common.fixturesDir + '/keys/agent1-key.pem'); |
| 15 | +const cert = fs.readFileSync(common.fixturesDir + '/keys/agent1-cert.pem'); |
| 16 | +const secureContext = tls.createSecureContext({ key, cert }); |
| 17 | + |
| 18 | +const server = net.createServer(common.mustCall((conn) => { |
| 19 | + const options = { isServer: true, secureContext, server }; |
| 20 | + const socket = new tls.TLSSocket(conn, options); |
| 21 | + socket.once('data', common.mustCall(() => { |
| 22 | + socket._destroySSL(); // Should not crash. |
| 23 | + server.close(); |
| 24 | + })); |
| 25 | +})); |
| 26 | + |
| 27 | +server.listen(0, function() { |
| 28 | + const options = { |
| 29 | + port: this.address().port, |
| 30 | + rejectUnauthorized: false, |
| 31 | + }; |
| 32 | + tls.connect(options, function() { |
| 33 | + this.write('*'.repeat(1 << 20)); // Write more data than fits in a frame. |
| 34 | + this.on('error', this.destroy); // Server closes connection on us. |
| 35 | + }); |
| 36 | +}); |