[PROTON-2851] crash in pn_tls_start() if pn_tls_config_t freed after call to pn_tls()

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: proton-c-0.40.0
• Component/s: proton-c
• Assignee: Clifford Jansen
• Reporter: Ken Giusti
• Created: 19/Sep/24 15:44
• Updated: 19/Sep/24 15:45

Description

Probably not a realistic use-case but freeing the pn_tls_config_t instance after creating a pn_tls_t using it can crash:

 

int main(int argc, char *argv[])
{{{}}
    pn_tls_config_t *tls_conf = pn_tls_config(PN_TLS_MODE_CLIENT);
    pn_tls_t *tls_session = pn_tls(tls_conf);
    pn_tls_config_free(tls_conf);
    int rc = pn_tls_start(tls_session);
    if (rc != 0) {
        fprintf(stderr, "Failed to start TLS session (%d)\n", rc);
        return 1;
{{    }}}
    return 0;
}

Program terminated with signal SIGSEGV, Segmentation fault.
#0  SSL_new (ctx=0x26eeba0c) at ssl/ssl_lib.c:692
692        return ctx->method->ssl_new(ctx);
(gdb) bt
#0  SSL_new (ctx=0x26eeba0c) at ssl/ssl_lib.c:692
#1  0x00007ff5c45b472a in init_ssl_socket (ssl=0x26faf450, domain=0x26e7c6f0) at /home/kgiusti/work/proton/qpid-proton/c/src/tls/openssl.c:1222
#2  0x00007ff5c45b4216 in pni_tls_init (ssl=0x26faf450, domain=0x26e7c6f0, unused=0x0) at /home/kgiusti/work/proton/qpid-proton/c/src/tls/openssl.c:1100
#3  0x00007ff5c45b44a2 in pn_tls_start (tls=0x26faf450) at /home/kgiusti/work/proton/qpid-proton/c/src/tls/openssl.c:1148
#4  0x000000000042f1d4 in main (argc=1, argv=0x7ffc35f79938) at /home/kgiusti/tmp/skupper-router/tests/tls_relay.c:1351
(gdb) p *ctx

<garbage>