-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Closed
Description
Multiple calls to SSLManager::initializeClient with a null context can cause the SSLManager::_ptrDefaultClientContext to become null.
The mutex lock in SSLManager::defaultClientContext is not sufficient to protect the SSLManager::_ptrDefaultClientContext from being changed to null by the after testing it on https://github.com/pocoproject/poco/blame/master/NetSSL_OpenSSL/src/SSLManager.cpp#L151 and returning it on https://github.com/pocoproject/poco/blame/master/NetSSL_OpenSSL/src/SSLManager.cpp#L165.
A solution may be to also enter the mutex in SSLManager::initializeClient (and SSLManager::initializeServer).
Reactions are currently unavailable