From: Dmitry Eremin-Solenikov Date: Fri, 20 Jul 2018 17:49:28 +0000 (+0300) Subject: cert-cred: fix possible segfault when resetting cert retrieval function X-Git-Tag: gnutls_3_6_4~60^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3df5b7bc8a6496eb9efdb3586d25bfab109e78db;p=thirdparty%2Fgnutls.git cert-cred: fix possible segfault when resetting cert retrieval function Reset get_cert_callback3 callback to NULL if provided callback is NULL. Otherwise after the certificate request call_legacy_cert_cb1 / call_legacy_cert_cb2 will try to unconditionally call legacy_cert_cb1 / legacy_cert_cb2 callback (set to NULL) leading to segfault. Fixes: 9829ef9a3ca06d60472599df7c74ebb9a53f1fe2 Signed-off-by: Dmitry Eremin-Solenikov --- diff --git a/lib/cert-cred.c b/lib/cert-cred.c index d3777e51ff..c219e6e353 100644 --- a/lib/cert-cred.c +++ b/lib/cert-cred.c @@ -503,7 +503,10 @@ void gnutls_certificate_set_retrieve_function gnutls_certificate_retrieve_function * func) { cred->legacy_cert_cb1 = func; - cred->get_cert_callback3 = call_legacy_cert_cb1; + if (!func) + cred->get_cert_callback3 = NULL; + else + cred->get_cert_callback3 = call_legacy_cert_cb1; } static int call_legacy_cert_cb2(gnutls_session_t session, @@ -578,7 +581,10 @@ void gnutls_certificate_set_retrieve_function2 gnutls_certificate_retrieve_function2 * func) { cred->legacy_cert_cb2 = func; - cred->get_cert_callback3 = call_legacy_cert_cb2; + if (!func) + cred->get_cert_callback3 = NULL; + else + cred->get_cert_callback3 = call_legacy_cert_cb2; } /** diff --git a/tests/Makefile.am b/tests/Makefile.am index f6d89ab6b3..1081027c03 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -197,7 +197,8 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei x509sign-verify-error rng-op-nonce rng-op-random rng-op-key x509-dn-decode-compat \ ip-check mini-x509-ipaddr trust-store base64-raw random-art dhex509self \ dss-sig-val sign-pk-api tls-session-ext-override record-pad \ - tls13-server-kx-neg gnutls_ext_raw_parse_dtls key-export-pkcs8 + tls13-server-kx-neg gnutls_ext_raw_parse_dtls key-export-pkcs8 \ + null_retrieve_function if HAVE_SECCOMP_TESTS ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp diff --git a/tests/null_retrieve_function.c b/tests/null_retrieve_function.c new file mode 100644 index 0000000000..4eaee869fc --- /dev/null +++ b/tests/null_retrieve_function.c @@ -0,0 +1,129 @@ +/* + * Copyright (C) 2011-2012 Free Software Foundation, Inc. + * Copyright (C) 2018 Dmitry Eremin-Solenikov + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Parts copied from GnuTLS example programs. */ + +#ifdef HAVE_CONFIG_H +#include +#endif + +#include +#include +#include +#include +#include + +#include "utils.h" +#include "cert-common.h" + +/* Test for memory allocations in a non-matching key-cert pair loading. + * + */ + +static int cert_cb1(gnutls_session_t session, + const gnutls_datum_t * req_ca_rdn, + int nreqs, + const gnutls_pk_algorithm_t * pk_algos, + int pk_algos_length, + gnutls_retr2_st *retr) +{ + return -1; +} + +static int cert_cb2(gnutls_session_t session, + const gnutls_datum_t *req_ca_rdn, + int nreqs, + const gnutls_pk_algorithm_t *pk_algos, + int pk_algos_length, + gnutls_pcert_st** pcert, + unsigned int *pcert_length, + gnutls_privkey_t *privkey) +{ + return -1; +} + +static int cert_cb3(gnutls_session_t session, + const struct gnutls_cert_retr_st *info, + gnutls_pcert_st **certs, + unsigned int *pcert_length, + gnutls_ocsp_data_st **ocsp, + unsigned int *ocsp_length, + gnutls_privkey_t *privkey, + unsigned int *flags) +{ + return -1; +} + + +static void tls_log_func(int level, const char *str) +{ + fprintf(stderr, "<%d>| %s", level, str); +} + +void doit(void) +{ + gnutls_certificate_credentials_t x509_cred; + gnutls_certificate_credentials_t clicred; + int ret; + + /* this must be called once in the program + */ + global_init(); + + gnutls_global_set_log_function(tls_log_func); + if (debug) + gnutls_global_set_log_level(6); + + gnutls_certificate_allocate_credentials(&x509_cred); + + ret = gnutls_certificate_set_x509_key_mem(x509_cred, &server_ca3_localhost_cert_chain, + &server_ca3_key, + GNUTLS_X509_FMT_PEM); + if (ret < 0) { + fail("error in error code\n"); + exit(1); + } + + gnutls_certificate_allocate_credentials(&clicred); + gnutls_certificate_set_retrieve_function(clicred, cert_cb1); + gnutls_certificate_set_retrieve_function(clicred, NULL); + _test_cli_serv(x509_cred, clicred, "NORMAL", "NORMAL", "localhost", NULL, NULL, NULL, 0, 1, GNUTLS_E_NO_CERTIFICATE_FOUND, -1); + gnutls_certificate_free_credentials(clicred); + + gnutls_certificate_allocate_credentials(&clicred); + gnutls_certificate_set_retrieve_function2(clicred, cert_cb2); + gnutls_certificate_set_retrieve_function2(clicred, NULL); + _test_cli_serv(x509_cred, clicred, "NORMAL", "NORMAL", "localhost", NULL, NULL, NULL, 0, 1, GNUTLS_E_NO_CERTIFICATE_FOUND, -1); + gnutls_certificate_free_credentials(clicred); + + gnutls_certificate_allocate_credentials(&clicred); + gnutls_certificate_set_retrieve_function3(clicred, cert_cb3); + gnutls_certificate_set_retrieve_function3(clicred, NULL); + _test_cli_serv(x509_cred, clicred, "NORMAL", "NORMAL", "localhost", NULL, NULL, NULL, 0, 1, GNUTLS_E_NO_CERTIFICATE_FOUND, -1); + gnutls_certificate_free_credentials(clicred); + + gnutls_certificate_free_credentials(x509_cred); + + gnutls_global_deinit(); + + if (debug) + success("success"); +}