Fix heap use after free in TLS conn on errors

When a error causes the TLS connection to fail and stop, the conn struct is free on Tls_close_by_key(), so writing to conn->in_connect is not correct after that point. The solution is to only set the flag when the it is still valid. Reported-by: Alex <[email protected]> Link: https://lists.mailman3.com/hyperkitty/list/[email protected]/thread/TY2JYCIPC7IQ32U6VC7ZOV3FVFFOE5K3/
dillo-browser · Sep 11, 2024 · f8ddd50 · f8ddd50
1 parent 8faec1d
commit f8ddd50
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/IO/tls_openssl.c b/src/IO/tls_openssl.c
@@ -1186,7 +1186,10 @@ static void Tls_connect(int fd, int connkey)
       if (a_Klist_get_data(conn_list, connkey)) {
          conn->connecting = FALSE;
          if (failed) {
+            conn->in_connect = FALSE;
             Tls_close_by_key(connkey);
+            /* conn is freed now */
+            conn = NULL;
          }
          a_IOwatch_remove_fd(fd, DIO_READ|DIO_WRITE);
          a_Http_connect_done(fd, failed ? FALSE : TRUE);
@@ -1195,7 +1198,8 @@ static void Tls_connect(int fd, int connkey)
       }
    }
 
-   conn->in_connect = FALSE;
+   if (conn)
+      conn->in_connect = FALSE;
 }
 
 static void Tls_connect_cb(int fd, void *vconnkey)