net.openssl: fix double-free on shutdown()#27482
Conversation
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
a515cc0 to
e1bdc14
Compare
The issue can be reliably reproduced by configuring a SOCKS5 proxy server, as follows.
import net.http
import rand
import time
proxy_user := rand.string(16)
proxy_pass := rand.string(16)
proxy_url := 'socks5://${proxy_user}:${proxy_pass}@127.0.0.1:9050'
mut config := http.FetchConfig{
url: 'https://vlang.io'
proxy: http.new_http_proxy(proxy_url) or { panic(err) }
}
mut resp := http.Response{}
for {
resp = http.fetch(config) or {
println('Failed to fetch data from the server!')
return
}
if resp.status_code != 200 {
println('Bad status code: ${resp.status_code}\n')
time.sleep(time.second * 10)
continue
}
break
}
Backtrace:
X509_VERIFY_PARAM_free (param=0xfeff) at ../crypto/x509/x509_vpm.c:100
0x00007ffff7da37fc in SSL_CTX_free (a=0x555555626a00) at ../ssl/ssl_lib.c:4405
0x00007ffff7da4aed in SSL_free (s=0x55555562dfb0) at ../ssl/ssl_lib.c:1446
0x000055555558b144 in net__openssl__SSLConn_shutdown ()
0x00005555555966b1 in net__http__HttpProxy_http_do ()
0x0000555555598b08 in net__http__Request_method_and_url_to_response ()
0x0000555555594b06 in net__http__Request_do ()
0x00005555555947e4 in net.http.fetch ()
0x000055555559bfb9 in main.main ()
0x000055555559c997 in main ()
e1bdc14 to
8800b76
Compare
Is this caused by my changes? |
|
Very doubtful. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8800b76d8a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if res == 0 { | ||
| // Second SSL_shutdown() needed for full bidirectional shutdown. | ||
| continue |
There was a problem hiding this comment.
Wait on retryable SSL_shutdown(0) results
When the underlying socket is non-blocking, such as builds using -d net_nonblocking_sockets or callers that set the TCP fd non-blocking, OpenSSL can return 0 from SSL_shutdown() because the shutdown is still in progress and SSL_get_error() would report SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE. This unconditional continue skips the existing wait logic below, so shutdown can busy-spin until the fd happens to become ready or forever if it never does; handle res == 0 through ssl_error() and wait/retry instead of immediately looping.
Useful? React with 👍 / 👎.
The issue can be reliably reproduced by configuring a SOCKS5 proxy server, as follows: