upstream/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-05-28 04:12:47 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

OCSP: resolve cleanup on connection close

Browse source 
Previously, when a client SSL connection was terminated (typically due to a
timeout) while resolving an OCSP responder, the OCSP context was freed, but
the resolve context was not.  This resulted in use-after-free on resolve
completion.

Reported by Leo Lin.
This commit is contained in:
Roman Arutyunyan 2026-04-21 14:51:41 +04:00 committed by Sergey Kandaurov
parent 319b4ea63f
commit 71841dcedf
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
src/event/ngx_event_openssl_stapling.c
View file

@ -113,6 +113,7 @@ struct ngx_ssl_ocsp_ctx_s {
ngx_resolver_t *resolver;
ngx_msec_t resolver_timeout;
ngx_resolver_ctx_t *resolve;
ngx_msec_t timeout;
@ -1341,6 +1342,10 @@ ngx_ssl_ocsp_done(ngx_ssl_ocsp_ctx_t *ctx)
ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
"ssl ocsp done");
if (ctx->resolve) {
ngx_resolve_name_done(ctx->resolve);
}
if (ctx->peer.connection) {
ngx_close_connection(ctx->peer.connection);
}
@ -1433,7 +1438,10 @@ ngx_ssl_ocsp_request(ngx_ssl_ocsp_ctx_t *ctx)
resolve->data = ctx;
resolve->timeout = ctx->resolver_timeout;
ctx->resolve = resolve;
if (ngx_resolve_name(resolve) != NGX_OK) {
ctx->resolve = NULL;
ngx_ssl_ocsp_error(ctx);
return;
}
@ -1522,6 +1530,7 @@ ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve)
}
ngx_resolve_name_done(resolve);
ctx->resolve = NULL;
ngx_ssl_ocsp_connect(ctx);
return;
@ -1529,6 +1538,8 @@ ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve)
failed:
ngx_resolve_name_done(resolve);
ctx->resolve = NULL;
ngx_ssl_ocsp_error(ctx);
}