mainGnuTLS - Support: sr #108548, gnutls crashes if connecting to a...

 
 

sr #108548: gnutls crashes if connecting to a TLS server with many subject Alt Names

Submitter:  None
Submitted:  Fri 18 Apr 2014 08:52:26 PM UTC
   
 
Category:  Core library Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  nmav
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 19 Apr 2014 10:19:43 AM UTC, comment #1: 

Thank you for reporting that. I guess this is on 3.3.0 only? I've committed a fix in the repository.

Nikos Mavrogiannopoulos <nmav>
Group administrator
Fri 18 Apr 2014 08:52:26 PM UTC, original submission:  

When connecting (via glib-networking) to a TLS server which produces a certificate with many SANs, and using an identity which is in the SANs list, the client crashes with SIGSEGV.

I ran into this bug in evolution (see https://bugzilla.gnome.org/show_bug.cgi?id=728239) and managed to reproduce it in a small client.

You can grab it from my git repo at https://git.geekwu.org/gnutls-test/gnutls-test/source/0feef3d6bc2e9b8d8b90e3335c00126cd7d499e3:

Here is the backtrace :
start
[New Thread 0x7ffff567a700 (LWP 15720)]
[New Thread 0x7fffee5c3700 (LWP 15722)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffee5c3700 (LWP 15722)]
0x00007fffed2cdbf4 in gnutls_subject_alt_names_get (sans=0x7fffe800fe00, seq=19, seq@entry=1, san_type=0x0, san_type@entry=0x7fffee5c2744, san=0x7fffe8051f78, san@entry=0x7fffee5c2760, othername_oid=othername_oid@entry=0x0)
    at x509_ext.c:125
125                     othername_oid->data = sans->names[seq].othername_oid.data;
(gdb) thread apply all backtrace

Thread 3 (Thread 0x7fffee5c3700 (LWP 15722)):
#0  0x00007fffed2cdbf4 in gnutls_subject_alt_names_get (sans=0x7fffe800fe00, seq=19, seq@entry=1, san_type=0x0, san_type@entry=0x7fffee5c2744, san=0x7fffe8051f78, san@entry=0x7fffee5c2760, othername_oid=othername_oid@entry=0x0)
    at x509_ext.c:125
#1  0x00007fffed2c2df0 in get_alt_name (cert=cert@entry=0x7fffe8010a10, extension_id=extension_id@entry=0x7fffed31e682 "2.5.29.17", seq=seq@entry=1, alt=alt@entry=0x7fffee5c27f0 "arrakeen.geekwu.org",
    alt_size=alt_size@entry=0x7fffee5c27e8, alt_type=alt_type@entry=0x0, critical=critical@entry=0x0, othername_oid=0) at x509.c:1310
#2  0x00007fffed2c4c9f in gnutls_x509_crt_get_subject_alt_name (cert=cert@entry=0x7fffe8010a10, seq=seq@entry=1, san=san@entry=0x7fffee5c27f0, san_size=san_size@entry=0x7fffee5c27e8, critical=critical@entry=0x0) at x509.c:1375
#3  0x00007fffed2c00ae in gnutls_x509_crt_check_hostname2 (cert=0x7fffe8010a10, hostname=0x610d60 "openid.geekwu.org", flags=flags@entry=0) at rfc2818_hostname.c:102
#4  0x00007fffed2c0177 in gnutls_x509_crt_check_hostname (cert=<optimized out>, hostname=<optimized out>) at rfc2818_hostname.c:50
#5  0x00007fffed79f117 in g_tls_certificate_gnutls_verify_identity (gnutls=0x7ffff0002550, identity=identity@entry=0x611830) at gtlscertificate-gnutls.c:537
#6  0x00007fffed7a3bd1 in g_tls_database_gnutls_verify_chain (database=<optimized out>, chain=0x7ffff0002550, purpose=<optimized out>, identity=0x611830, interaction=0x0, flags=<optimized out>, cancellable=0x0, error=0x7fffee5c2a58)
    at gtlsdatabase-gnutls.c:321
#7  0x00007fffed7a19be in verify_peer_certificate (peer_certificate=0x7ffff0002550, gnutls=0x673160) at gtlsconnection-gnutls.c:1128
#8  handshake_thread (task=0x64c1e0, object=object@entry=0x673160, task_data=<optimized out>, cancellable=<optimized out>) at gtlsconnection-gnutls.c:1217
#9  0x00007fffed7a1b29 in async_handshake_thread (task=<optimized out>, object=0x673160, task_data=<optimized out>, cancellable=<optimized out>) at gtlsconnection-gnutls.c:1383
#10 0x00007ffff7aeb9f5 in g_task_thread_pool_thread (thread_data=0x64c1e0, pool_data=<optimized out>) at gtask.c:1213
#11 0x00007ffff758161c in g_thread_pool_thread_proxy (data=<optimized out>) at gthreadpool.c:307
#12 0x00007ffff7580c95 in g_thread_proxy (data=0x611d40) at gthread.c:764
#13 0x00007ffff5ec10a2 in start_thread () from /usr/lib/libpthread.so.0
#14 0x00007ffff6a35d1d in clone () from /usr/lib/libc.so.6

Thread 2 (Thread 0x7ffff567a700 (LWP 15720)):
#0  0x00007ffff6a2d35d in poll () from /usr/lib/libc.so.6
#1  0x00007ffff755bd64 in g_main_context_poll (priority=2147483647, n_fds=1, fds=0x7ffff00010e0, timeout=-1, context=0x6427e0) at gmain.c:4028
#2  g_main_context_iterate (context=context@entry=0x6427e0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3729
#3  0x00007ffff755be6c in g_main_context_iteration (context=0x6427e0, may_block=1) at gmain.c:3795
#4  0x00007ffff568217d in ?? () from /usr/lib/gio/modules/libdconfsettings.so
#5  0x00007ffff7580c95 in g_thread_proxy (data=0x6119e0) at gthread.c:764
#6  0x00007ffff5ec10a2 in start_thread () from /usr/lib/libpthread.so.0
#7  0x00007ffff6a35d1d in clone () from /usr/lib/libc.so.6

Thread 1 (Thread 0x7ffff7fbd740 (LWP 15716)):
#0  0x00007ffff6a2d35d in poll () from /usr/lib/libc.so.6
#1  0x00007ffff755bd64 in g_main_context_poll (priority=2147483647, n_fds=1, fds=0x645530, timeout=-1, context=0x60cee0) at gmain.c:4028
#2  g_main_context_iterate (context=0x60cee0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3729
#3  0x00007ffff755c08a in g_main_loop_run (loop=0x60d0c0) at gmain.c:3928
#4  0x0000000000400ce0 in main () at main.cpp:32


I did not managed to reproduce it outside of glib yet

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-10 nmav StatusNone Done
        Assigned toNone nmav
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code