Changeset 6091

Timestamp:

Oct 11, 2019 2:26:12 PM (5 years ago)

Author:

riza

Message:

Fix #2244: Prevent continuous memory allocation when getting raw certificate on TLS.

Location:

pjproject/trunk/pjlib/src/pj

Files:

• ssl_sock_gtls.c (modified) (2 diffs)
• ssl_sock_imp_common.c (modified) (3 diffs)
• ssl_sock_imp_common.h (modified) (1 diff)
• ssl_sock_ossl.c (modified) (1 diff)

pjproject/trunk/pjlib/src/pj/ssl_sock_gtls.c

@@ -1051 +1051 @@
 
     tls_cert_get_info(ssock->pool, &ssock->local_cert_info, cert);
-    tls_cert_get_chain_raw(ssock->pool, &ssock->local_cert_info, us, 1);
+    pj_pool_reset(ssock->info_pool);
+    tls_cert_get_chain_raw(ssock->info_pool, &ssock->local_cert_info, us, 1);
 
 us_out:
@@ -1078 +1079 @@
 
     tls_cert_get_info(ssock->pool, &ssock->remote_cert_info, cert);
-    tls_cert_get_chain_raw(ssock->pool, &ssock->remote_cert_info, certs,
+    pj_pool_reset(ssock->info_pool);
+    tls_cert_get_chain_raw(ssock->info_pool, &ssock->remote_cert_info, certs,
                            certslen);
 

pjproject/trunk/pjlib/src/pj/ssl_sock_imp_common.c

@@ -620 +620 @@
 
     /* Secure release pool, i.e: all memory blocks will be zeroed first */
+    pj_pool_secure_release(&ssock->info_pool);
     pj_pool_secure_release(&ssock->pool);
 }
@@ -1267 +1268 @@
     pj_ssl_sock_t *ssock;
     pj_status_t status;
+    pj_pool_t *info_pool;
 
     PJ_ASSERT_RETURN(pool && param && p_ssock, PJ_EINVAL);
     PJ_ASSERT_RETURN(param->sock_type == pj_SOCK_STREAM(), PJ_ENOTSUP);
 
+    info_pool = pj_pool_create(pool->factory, "ssl_chain%p", 512, 512, NULL);
     pool = pj_pool_create(pool->factory, "ssl%p", 512, 512, NULL);
 
@@ -1276 +1279 @@
     ssock = ssl_alloc(pool);
     ssock->pool = pool;
+    ssock->info_pool = info_pool;
     ssock->sock = PJ_INVALID_SOCKET;
     ssock->ssl_state = SSL_STATE_NULL;

pjproject/trunk/pjlib/src/pj/ssl_sock_imp_common.h

@@ -97 +97 @@
 {
     pj_pool_t            *pool;
+    pj_pool_t            *info_pool; /* this is for certificate chain 
+                                      * information allocation. Don't use for 
+                                      * other purposes. */
     pj_ssl_sock_t        *parent;
     pj_ssl_sock_param     param;

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -1710 +1710 @@
     chain = SSL_get_peer_cert_chain(ossock->ossl_ssl);
     if (chain) {
-       ssl_update_remote_cert_chain_info(ssock->pool,
-                                         &ssock->remote_cert_info,
-                                         chain, PJ_TRUE);
+        pj_pool_reset(ssock->info_pool);
+        ssl_update_remote_cert_chain_info(ssock->info_pool,
+                                          &ssock->remote_cert_info,
+                                          chain, PJ_TRUE);
     } else {
-       ssock->remote_cert_info.raw_chain.cnt = 0;
+        ssock->remote_cert_info.raw_chain.cnt = 0;
     }
 }