From 66d49b49526c2352b65ea037e879dc4409ecc68d Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Tue, 29 Aug 2017 16:24:36 -0400 Subject: [PATCH] Fix SSL_CTX client_CA list locking. ctx->cached_x509_client_CA needs to be protected under a lock since SSL_CTX_get_client_CA_list is a logically const operation. The fallback in SSL_get_client_CA_list was not using this lock. Change-Id: I2431218492d1a853cc1a59c0678b0b50cd9beab2 Reviewed-on: https://boringssl-review.googlesource.com/19765 Reviewed-by: Steven Valdez Commit-Queue: David Benjamin CQ-Verified: CQ bot account: commit-bot@chromium.org --- ssl/ssl_x509.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ssl/ssl_x509.cc b/ssl/ssl_x509.cc index 7e9e51fa..e442dfb7 100644 --- a/ssl/ssl_x509.cc +++ b/ssl/ssl_x509.cc @@ -1158,12 +1158,13 @@ STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *ssl) { return buffer_names_to_x509( ssl->client_CA, (STACK_OF(X509_NAME) **)&ssl->cached_x509_client_CA); } - return buffer_names_to_x509(ssl->ctx->client_CA, - &ssl->ctx->cached_x509_client_CA); + return SSL_CTX_get_client_CA_list(ssl->ctx); } STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx) { check_ssl_ctx_x509_method(ctx); + /* This is a logically const operation that may be called on multiple threads, + * so it needs to lock around updating |cached_x509_client_CA|. */ CRYPTO_MUTEX_lock_write((CRYPTO_MUTEX *) &ctx->lock); STACK_OF(X509_NAME) *ret = buffer_names_to_x509( ctx->client_CA, (STACK_OF(X509_NAME) **)&ctx->cached_x509_client_CA);