mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 06:11:32 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: quic: Non initialized CRYPTO data stream deferencing

Browse Source 
This bug arrived with this commit:
   BUG/MINOR: quic: Useless use of non-contiguous buffer for in order CRYPTO data

Before this commit qc->cstream was tested before entering qc_treat_rx_crypto_frms().
This patch restablishes this behavior. Furthermore, it simplyfies
qc_ssl_provide_all_quic_data() which is a little bit ugly: the CRYPTO data
frame may be freed asap in the list_for_each_entry_safe() block after
having store its data pointer and length in local variables.
Also interrupt the CRYPTO data process as soon as qc_ssl_provide_quic_data()
or qc_treat_rx_crypto_frms() fail.

No need to be backported.
This commit is contained in:
Frédéric Lécaille 2023-11-13 09:06:59 +01:00
parent 59b313832a
commit 840af0928b
1 changed files with 9 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/quic_ssl.c
View File

@ -638,30 +638,28 @@ int qc_ssl_provide_all_quic_data(struct quic_conn *qc, struct ssl_sock_ctx *ctx)
TRACE_ENTER(QUIC_EV_CONN_PHPKTS, qc); TRACE_ENTER(QUIC_EV_CONN_PHPKTS, qc);
list_for_each_entry(qel, &qc->qel_list, list) { list_for_each_entry(qel, &qc->qel_list, list) {
int ssl_ret;
struct qf_crypto *qf_crypto, *qf_back; struct qf_crypto *qf_crypto, *qf_back;
ssl_ret = 1;
list_for_each_entry_safe(qf_crypto, qf_back, &qel->rx.crypto_frms, list) { list_for_each_entry_safe(qf_crypto, qf_back, &qel->rx.crypto_frms, list) {
ssl_ret = qc_ssl_provide_quic_data(&ncbuf, qel->level, ctx, const unsigned char *crypto_data = qf_crypto->data;
qf_crypto->data, qf_crypto->len); size_t crypto_len = qf_crypto->len;
/* Free this frame asap */ /* Free this frame asap */
LIST_DELETE(&qf_crypto->list); LIST_DELETE(&qf_crypto->list);
pool_free(pool_head_qf_crypto, qf_crypto); pool_free(pool_head_qf_crypto, qf_crypto);
if (!ssl_ret) { if (!qc_ssl_provide_quic_data(&ncbuf, qel->level, ctx,
TRACE_DEVEL("null ssl_ret", QUIC_EV_CONN_PHPKTS, qc, qel); crypto_data, crypto_len))
break; goto leave;
}
TRACE_DEVEL("buffered crypto data were provided to TLS stack", TRACE_DEVEL("buffered crypto data were provided to TLS stack",
QUIC_EV_CONN_PHPKTS, qc, qel); QUIC_EV_CONN_PHPKTS, qc, qel);
} }
if (!qc_treat_rx_crypto_frms(qc, qel, ctx)) if (!qel->cstream)
ssl_ret = 0; continue;
if (!ssl_ret) if (!qc_treat_rx_crypto_frms(qc, qel, ctx))
goto leave; goto leave;
} }