Changeset 5214

Timestamp:

Dec 11, 2015 4:59:56 AM (9 years ago)

Author:

ming

Message:

Fixed #1901: crash when async_cnt is set to a value greater than one for SIP TLS transport

Location:

pjproject/trunk

Files:

• pjlib/include/pj/ssl_sock.h (modified) (2 diffs)
• pjlib/src/pj/ssl_sock_common.c (modified) (2 diffs)
• pjlib/src/pj/ssl_sock_ossl.c (modified) (6 diffs)
• pjsip/src/pjsip/sip_transport_tls.c (modified) (2 diffs)

pjproject/trunk/pjlib/include/pj/ssl_sock.h

@@ -865 +865 @@
 
 /**
+ * Duplicate pj_ssl_sock_param.
+ *
+ * @param pool  Pool to allocate memory.
+ * @param dst   Destination parameter.
+ * @param src   Source parameter.
+ */
+PJ_DECL(void) pj_ssl_sock_param_copy(pj_pool_t *pool, 
+                                     pj_ssl_sock_param *dst,
+                                     const pj_ssl_sock_param *src);
+
+
+/**
  * Create secure socket instance.
  *
@@ -1116 +1128 @@
 
 /**
+ * Same as #pj_ssl_sock_start_accept(), but application can provide
+ * a secure socket parameter, which will be used to create a new secure
+ * socket reported in \a on_accept_complete() callback when there is
+ * an incoming connection.
+ *
+ * @param ssock         The secure socket.
+ * @param pool          Pool used to allocate some internal data for the
+ *                      operation.
+ * @param localaddr     Local address to bind on.
+ * @param addr_len      Length of buffer containing local address.
+ * @param newsock_param Secure socket parameter for new accepted sockets.
+ *
+ * @return              PJ_SUCCESS if the operation has been successful,
+ *                      or the appropriate error code on failure.
+ */
+PJ_DECL(pj_status_t)
+pj_ssl_sock_start_accept2(pj_ssl_sock_t *ssock,
+                          pj_pool_t *pool,
+                          const pj_sockaddr_t *local_addr,
+                          int addr_len,
+                          const pj_ssl_sock_param *newsock_param);
+
+
+/**
  * Starts asynchronous socket connect() operation and SSL/TLS handshaking 
  * for this socket. Once the connection is done (either successfully or not),

pjproject/trunk/pjlib/src/pj/ssl_sock_common.c

@@ -20 +20 @@
 #include <pj/assert.h>
 #include <pj/errno.h>
+#include <pj/pool.h>
 #include <pj/string.h>
 
@@ -46 +47 @@
     /* Security config */
     param->proto = PJ_SSL_SOCK_PROTO_DEFAULT;
+}
+
+
+/*
+ * Duplicate SSL socket parameter.
+ */
+PJ_DEF(void) pj_ssl_sock_param_copy( pj_pool_t *pool, 
+                                     pj_ssl_sock_param *dst,
+                                     const pj_ssl_sock_param *src)
+{
+    /* Init secure socket param */
+    pj_memcpy(dst, src, sizeof(*dst));
+    if (src->ciphers_num > 0) {
+        unsigned i;
+        dst->ciphers = (pj_ssl_cipher*)
+                        pj_pool_calloc(pool, src->ciphers_num, 
+                                       sizeof(pj_ssl_cipher));
+        for (i = 0; i < src->ciphers_num; ++i)
+            dst->ciphers[i] = src->ciphers[i];
+    }
+
+    if (src->server_name.slen) {
+        /* Server name must be null-terminated */
+        pj_strdup_with_null(pool, &dst->server_name, &src->server_name);
+    }
 }
 

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -142 +142 @@
     pj_ssl_sock_t        *parent;
     pj_ssl_sock_param     param;
+    pj_ssl_sock_param     newsock_param;
     pj_ssl_cert_t        *cert;
     
@@ -1758 +1759 @@
     pj_status_t status;
 
-    PJ_UNUSED_ARG(src_addr_len);
-
     /* Create new SSL socket instance */
-    status = pj_ssl_sock_create(ssock_parent->pool, &ssock_parent->param,
-                                &ssock);
+    status = pj_ssl_sock_create(ssock_parent->pool,
+                                &ssock_parent->newsock_param, &ssock);
     if (status != PJ_SUCCESS)
         goto on_return;
@@ -2184 +2183 @@
 
     /* Init secure socket param */
-    ssock->param = *param;
+    pj_ssl_sock_param_copy(pool, &ssock->param, param);
     ssock->param.read_buffer_size = ((ssock->param.read_buffer_size+7)>>3)<<3;
-    if (param->ciphers_num > 0) {
-        unsigned i;
-        ssock->param.ciphers = (pj_ssl_cipher*)
-                               pj_pool_calloc(pool, param->ciphers_num, 
-                                              sizeof(pj_ssl_cipher));
-        for (i = 0; i < param->ciphers_num; ++i)
-            ssock->param.ciphers[i] = param->ciphers[i];
-    }
-
-    /* Server name must be null-terminated */
-    pj_strdup_with_null(pool, &ssock->param.server_name, 
-                        &param->server_name);
 
     /* Finally */
@@ -2618 +2605 @@
                                               int addr_len)
 {
+    return pj_ssl_sock_start_accept2(ssock, pool, localaddr, addr_len,
+                                     &ssock->param);
+}
+
+
+/**
+ * Same as #pj_ssl_sock_start_accept(), but application provides parameter
+ * for new accepted secure sockets.
+ */
+PJ_DEF(pj_status_t)
+pj_ssl_sock_start_accept2(pj_ssl_sock_t *ssock,
+                          pj_pool_t *pool,
+                          const pj_sockaddr_t *localaddr,
+                          int addr_len,
+                          const pj_ssl_sock_param *newsock_param)
+{
     pj_activesock_cb asock_cb;
     pj_activesock_cfg asock_cfg;
@@ -2623 +2626 @@
 
     PJ_ASSERT_RETURN(ssock && pool && localaddr && addr_len, PJ_EINVAL);
+
+    /* Verify new socket parameters */
+    if (newsock_param->grp_lock != ssock->param.grp_lock ||
+        newsock_param->sock_af != ssock->param.sock_af ||
+        newsock_param->sock_type != ssock->param.sock_type)
+    {
+        return PJ_EINVAL;
+    }
 
     /* Create socket */
@@ -2692 +2703 @@
 
     /* Start accepting */
+    pj_ssl_sock_param_copy(pool, &ssock->newsock_param, newsock_param);
     status = pj_activesock_start_accept(ssock->asock, pool);
     if (status != PJ_SUCCESS)

pjproject/trunk/pjsip/src/pjsip/sip_transport_tls.c

@@ -315 +315 @@
     pj_uint32_t sip_ssl_proto;
     struct tls_listener *listener;
-    pj_ssl_sock_param ssock_param;
+    pj_ssl_sock_param ssock_param, newsock_param;
     pj_sockaddr *listener_addr;
     pj_bool_t has_listener;
@@ -472 +472 @@
     has_listener = PJ_FALSE;
 
-    status = pj_ssl_sock_start_accept(listener->ssock, pool, 
+    pj_memcpy(&newsock_param, &ssock_param, sizeof(newsock_param));
+    newsock_param.async_cnt = 1;
+    newsock_param.cb.on_data_read = &on_data_read;
+    newsock_param.cb.on_data_sent = &on_data_sent;
+    status = pj_ssl_sock_start_accept2(listener->ssock, pool, 
                           (pj_sockaddr_t*)listener_addr, 
-                          pj_sockaddr_get_len((pj_sockaddr_t*)listener_addr));
+                          pj_sockaddr_get_len((pj_sockaddr_t*)listener_addr),
+                          &newsock_param);
     if (status == PJ_SUCCESS || status == PJ_EPENDING) {
         pj_ssl_sock_info info;