[TS-3031] Race condition in SSLNextProtocolSet::advertiseProtocols

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 5.1.0
• Component/s: Core, SSL
• Assignee: Brian Geffon
• Reporter: Brian Geffon
• Created: 21/Aug/14 17:47
• Updated: 28/Apr/15 16:26
• Resolved: 21/Aug/14 19:04

Description

We've observed a bug in a production environment where clients would receive malformed NPN sets. This is caused by a race condition in SSLNextProtocolSet::advertiseProtocols:

 if (!npn && !this->endpoints.empty()) {    
   create_npn_advertisement(this->endpoints, &npn, &npnsz);
 }

Obviously this code is attempting to initailize the npn offer string on the first SSL request to that port, this is a race condition. I have a fix that will be committed today.

Issue Links

• is duplicated by: TS-3438 npn list being created with garbage data