Bugs item #2365300, was opened at 2008-11-30 17:31
Message generated for change (Settings changed) made by bagder
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=2365300&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: SSL/TLS
Group: crash
>Status: Pending
Resolution: Works For Me
Priority: 5
Private: No
Submitted By: Colin Leroy (colinleroy)
Assigned to: Daniel Stenberg (bagder)
Summary: Crash in Curl_nss_connect

Initial Comment:
Hello,

One of our users (user of Claws Mail's RSS plugin) gets crashes on https connections. Valgrind shows:

==31738== Invalid read of size 8
==31738== at 0x35C9A0BD0E: NSSRWLock_LockRead_Util (nssrwlk.c:177)
==31738== by 0x35C9650477: PK11_TokenExists (pk11slot.c:1734)
==31738== by 0x35CA20EBA6: ssl3_config_match_init (ssl3con.c:659)
==31738== by 0x35CA213E2E: ssl2_ConstructCipherSpecs (sslcon.c:206)
==31738== by 0x35CA215ED7: ssl2_BeginClientHandshake (sslcon.c:3018)
==31738== by 0x35CA21B454: ssl_Do1stHandshake (sslsecur.c:151)
==31738== by 0x35CA21C9CE: SSL_ForceHandshake (sslsecur.c:407)
==31738== by 0x35CA63BBCE: Curl_nss_connect (nss.c:1035)
==31738== by 0x35CA61590B: Curl_http_connect (http.c:1719)
==31738== by 0x35CA61BCD1: Curl_protocol_connect (url.c:2803)
==31738== by 0x35CA61E724: Curl_connect (url.c:4289)
==31738== by 0x35CA629C1A: Curl_perform (transfer.c:2291)

Is this known?

----------------------------------------------------------------------

Comment By: Daniel Stenberg (bagder)
Date: 2008-11-30 19:48

Message:
No, it isn't known.

The problem is quite clearly within NSS so I would point my finger at
"them". Fedora uses a patched NSS (and patched libcurl) so I would suggest
you start off reporting your problem to them.

If you can repeat this problem with up-to-date "stock" versions of NSS and
libcurl I'll be very interested in a source code that shows how to do it!

----------------------------------------------------------------------

Comment By: Colin Leroy (colinleroy)
Date: 2008-11-30 17:35

Message:
btw our code does call curl_global_init(CURL_GLOBAL_DEFAULT).

----------------------------------------------------------------------

Comment By: Colin Leroy (colinleroy)
Date: 2008-11-30 17:32

Message:
More info about the user's Curl version:
$ rpm -qi libcurl.x86_64
Name : libcurl Relocations: (not relocatable)
Version : 7.18.2 Vendor: Fedora Project
Release : 6.fc9 Build Date: Fri 19 Sep 2008
18:34:20 BST
Install Date: Thu 25 Sep 2008 07:44:22 BST Build Host:
x86-4.fedora.phx.redhat.com
Group : Development/Libraries Source RPM:
curl-7.18.2-6.fc9.src.rpm
Size : 301872 License: MIT
Signature : DSA/SHA1, Tue 23 Sep 2008 23:48:29 BST, Key ID
62aec3dc6df2196f
Packager : Fedora Project
URL : http://curl.haxx.se/
Summary : A library for getting files from web servers
Description :
This package provides a way for applications to use FTP, HTTP, Gopher and
other servers for getting files.

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=2365300&group_id=976
Received on 2008-12-03