-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Race condition in SSLManager #3558
Copy link
Copy link
Closed
Description
Multiple calls to SSLManager::initializeClient with a null context can cause the SSLManager::_ptrDefaultClientContext to become null.
The mutex lock in SSLManager::defaultClientContext is not sufficient to protect the SSLManager::_ptrDefaultClientContext from being changed to null by the after testing it on https://github.com/pocoproject/poco/blame/master/NetSSL_OpenSSL/src/SSLManager.cpp#L151 and returning it on https://github.com/pocoproject/poco/blame/master/NetSSL_OpenSSL/src/SSLManager.cpp#L165.
A solution may be to also enter the mutex in SSLManager::initializeClient (and SSLManager::initializeServer).
Reactions are currently unavailable