Skip to content

Race condition in SSLManager #3558

@vipw

Description

@vipw

Multiple calls to SSLManager::initializeClient with a null context can cause the SSLManager::_ptrDefaultClientContext to become null.

The mutex lock in SSLManager::defaultClientContext is not sufficient to protect the SSLManager::_ptrDefaultClientContext from being changed to null by the after testing it on https://github.com/pocoproject/poco/blame/master/NetSSL_OpenSSL/src/SSLManager.cpp#L151 and returning it on https://github.com/pocoproject/poco/blame/master/NetSSL_OpenSSL/src/SSLManager.cpp#L165.

A solution may be to also enter the mutex in SSLManager::initializeClient (and SSLManager::initializeServer).

Metadata

Metadata

Labels

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions