Fix for Mathopd Segmentation fault using SSL Patch

--0016364182b945da6004646af34a
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

*Problem:*

When both HTTP and HTTPS support in mathopd is used simultaneously (using
multiple server blocks in the mathopd configuration file), mathopd is killed
with Segmentation fault.

In this scenario, only the HTTPS connections will contain valid SSL contexts
(i.e valid openssl_connection pointer in struct connection). Whenever a
connection is closed, the openssl_connection pointer is also cleaned up if
it is valid (i.e not NULL). But the openssl_connection pointer is not
reinitialized to NULL after freeing the memory. And this connection is
returned to the free pool of connections for use in subsequent connections.
If this connection structure is subsequently assigned for a HTTP connection,
then during connection close, the openssl_connection is again cleaned up
since it is not NULL. This causes segmentation fault.

*Fix:*

The fix is to initialize the SSL context to NULL on connection close
(close_connection function in core.c):
The patch for this fix is as below:

 --- old/mathopd/core.c    2009-03-05 16:38:28.000000000 +0530
+++ new/mathopd/core.c    2009-03-05 16:41:32.000000000 +0530
@@ -196,6 +196,9 @@
 #ifdef USE_SSL_OPENSSL
     if(cn->openssl_connection)
         SSL_free (cn->openssl_connection);
+    // Initialize to NULL to avoid invalid access later
+    // when this connection is used for a HTTP connection
+    cn->openssl_connection = NULL;
 #endif

     if (cn->rfd != -1) {

regards

Keerthana

--0016364182b945da6004646af34a
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable



<p><b><font size=3D"2" face=3D"Arial"><span style=3D"font-size: 10pt; font-=
family: Arial;">Problem:</span></font></b></p><p><font size=3D"2" face=3D"A=
rial"><span style=3D"font-size: 10pt; font-family: Arial;">When both HTTP a=
nd HTTPS
support in mathopd is used simultaneously (using multiple server blocks in =
the mathopd configuration file), mathopd is killed with </span></font><font=
 size=3D"2" face=3D"Arial"><span style=3D"font-size: 10pt; font-family: Ari=
al;">Segmentation fault.</span></font><font size=3D"2" face=3D"Arial"><span=
 style=3D"font-size: 10pt; font-family: Arial;"></span></font></p>





<p><font size=3D"2" face=3D"Arial"><span style=3D"font-size: 10pt; font-fam=
ily: Arial;">In this scenario, only the
HTTPS connections will contain valid SSL contexts (i.e valid openssl_connec=
tion
pointer in struct connection). Whenever a connection is closed, the openssl=
_connection
pointer is also cleaned up if it is valid (i.e not NULL). But the openssl_c=
onnection
pointer is not reinitialized to NULL after freeing the memory. And this
connection is returned to the free pool of connections for use in subsequen=
t
connections. If this connection structure is subsequently assigned for a HT=
TP
connection, then during connection close, the openssl_connection is again
cleaned up since it is not NULL. This causes segmentation fault.</span></fo=
nt></p>



<p><font size=3D"2" face=3D"Arial"><span style=3D"font-size: 10pt; font-fam=
ily: Arial;"><b>Fix:</b><br></span></font></p><p><font size=3D"2" face=3D"A=
rial"><span style=3D"font-size: 10pt; font-family: Arial;">The fix is to in=
itialize the SSL context to NULL on
connection close (close_connection function in core.c):</span></font></p>Th=
e patch for this fix is as below:<br><p><font size=3D"2" face=3D"Arial"><sp=
an style=3D"font-size: 10pt; font-family: Arial;">=A0--- old/mathopd/core.c=
=A0=A0 =A02009-03-05 16:38:28.000000000 +0530<br>
+++ new/mathopd/core.c=A0=A0 =A02009-03-05 16:41:32.000000000 +0530<br>@@ -=
196,6 +196,9 @@<br>=A0#ifdef USE_SSL_OPENSSL<br>=A0=A0=A0 =A0if(cn-&gt;open=
ssl_connection)<br>=A0=A0=A0 =A0=A0=A0 =A0SSL_free (cn-&gt;openssl_connecti=
on);<br>+=A0=A0 =A0// Initialize to NULL to avoid invalid access later<br>
+=A0=A0 =A0// when this connection is used for a HTTP connection<br>+=A0=A0=
=A0 cn-&gt;openssl_connection =3D NULL;<br>=A0#endif<br>=A0<br>=A0=A0=A0 =
=A0if (cn-&gt;rfd !=3D -1) {<br></span></font></p><p><font size=3D"2" face=
=3D"Arial"><span style=3D"font-size: 10pt; font-family: Arial;">regards</sp=
an></font></p>
<p><font size=3D"2" face=3D"Arial"><span style=3D"font-size: 10pt; font-fam=
ily: Arial;">Keerthana<br></span></font></p>


--0016364182b945da6004646af34a--