From a51a4865608833d207b52535963a8fb6d75caad9 Mon Sep 17 00:00:00 2001 From: Brad Arant Date: Tue, 25 Aug 2026 18:56:27 -0700 Subject: [PATCH] Fix uninitialized tlsInfo causing random SSL_read/write on plain sockets TCPSocket's SSL_CTX*-taking constructor - the one every accepted TCPSession actually goes through (TCPSession(EPoll&, TCPServer*, ...) passes server->ctx into it) - never initialized the `tlsInfo` member, and TCPSocket.h gave it no default either. Every session's `tlsInfo` was uninitialized garbage. receiveData()/sendData() key their TLS-vs-plain dispatch on `if(tlsInfo)`. Since that garbage value is non-zero often enough on a real stack, sessions on a plain, non-TLS server were intermittently routed through TLS::receiveData()/sendData() (SSL_read()/SSL_write()) against an also-uninitialized SSL*, segfaulting inside libssl. Confirmed via dmesg: repeated "general protection fault ... in libssl.so.3", signal 11, non-deterministic timing consistent with depending on whatever garbage happened to be on the stack for a given session. Fixed by dispatching on `ctx` instead of `tlsInfo`. `ctx` (TLS.h) now defaults to NULL (previously also uninitialized) and is the value that actually gets set for real in TLS::createContext() and correctly inherited by every session via TLS(SSL_CTX*) - unlike `tlsInfo`, which is only ever set on the listening TCPServer's own constructor and never propagated to sessions at all. For the previously-working TLS-enabled case this is a no-op: ctx and tlsInfo were always both set (or both unset) together on the listening server, so the observable behavior there is unchanged - only the previously-undefined session-level behavior is fixed. Verified live: restarted the APIServer test instance (a plain, non-TLS TCPServer - the exact configuration that was crashing), ran 100 sequential requests with no failures, and confirmed no new libssl segfaults in dmesg since the fix (three separate pre-fix crash incidents are all still visible in the dmesg history for comparison). Co-Authored-By: Claude Sonnet 5 --- TCPSocket.cpp | 13 +++++++++++-- TLS.h | 7 ++++++- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/TCPSocket.cpp b/TCPSocket.cpp index 17f10dc..1d7b555 100644 --- a/TCPSocket.cpp +++ b/TCPSocket.cpp @@ -28,7 +28,16 @@ namespace core { } void TCPSocket::receiveData(coreutils::ZString &buffer) { - if(tlsInfo) { + // Dispatch on `ctx`, not `tlsInfo` - the SSL_CTX*-taking constructor + // (used for every accepted TCPSession) never sets `tlsInfo` at all, + // leaving it as uninitialized garbage that intermittently (whenever + // that garbage happened to be non-zero) routed a plain, non-TLS + // session's data through SSL_read()/SSL_write() against an + // uninitialized SSL*, segfaulting inside libssl. `ctx` is the + // reliable signal: real and non-NULL for an actual TLS server/ + // session (set in TLS::createContext(), inherited by sessions via + // TLS(SSL_CTX*)), safely NULL by default otherwise (see TLS.h). + if(ctx) { int len = TLS::receiveData(buffer); if(len >= 0) { coreutils::ZString zbuffer(buffer.getData(), len); @@ -40,7 +49,7 @@ namespace core { } int TCPSocket::sendData(const char *data, int length) { - if(tlsInfo) + if(ctx) return TLS::sendData(data, length); else return Socket::sendData(data, length); diff --git a/TLS.h b/TLS.h index 75f7a63..3bfdfb4 100644 --- a/TLS.h +++ b/TLS.h @@ -46,7 +46,12 @@ namespace core { void createContext(TLSInfo *tlsInfo); - SSL_CTX *ctx; + // A never-configured TLS object (either the listening TCPServer + // itself when constructed with tlsInfo=NULL, or a TCPSession spawned + // from one via TLS(SSL_CTX*)) must default to a real NULL here, not + // garbage - TCPSocket::receiveData()/sendData() key their TLS-vs- + // plain dispatch on this exact value (see TCPSocket.cpp). + SSL_CTX *ctx = NULL; protected: int receiveData(coreutils::ZString &buffer);