bugGNU Wget - Bugs: bug #62137, wget segfaults when using openssl...

 
 

bug #62137: wget segfaults when using openssl and a FTPS server in TLS 1.3

Submitter:  BurningZeRoad <burningzeroad>
Submitted:  Thu 03 Mar 2022 11:14:57 AM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  Ready for Merge
Privacy:  Public Assigned to:  darnir
Originator Name:  Bruno Fleurette Open/Closed:  Open
Release:  None Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  Yes
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 25 Jul 2023 05:39:39 AM UTC, comment #2: 

Thanks for your comment @Anonymous.
It's good to know my debug work has been useful... ;)

BurningZeRoad <burningzeroad>
Mon 24 Jul 2023 10:45:45 PM UTC, comment #1: 

This fixes my long standing crash issue too (I had to run our backups still with an very old wget w/o this SSL crash, because I was unable to get it working with a recent build w/o segfaulting.) Thanks for the patch!

Can we expect this to get merged soon?

Anonymous
Thu 03 Mar 2022 11:14:57 AM UTC, original submission:  

Hello,

I was faced with this segfault when downloading a file from FileZilla server 1.3.0 :

~ # wget -c ftps://192.168.137.243/test.zip -O /var/tmp/test.zip
--2022-03-03 11:39:46--  ftps://192.168.137.243/test.zip
           => '/var/tmp/test.zip'
Connecting to 192.168.137.243:21... connected.
==> AUTH TLS ... WARNING: cannot verify 192.168.137.243's certificate, issued by 'CN=filezilla-server self signed certificate':
  Self-signed certificate encountered.
    WARNING: certificate common name 'filezilla-server self signed certificate' doesn't match requested host name '192.168.137.243'.
 done.
Logging in as anonymous ... Logged in!
==> PBSZ 0 ... done.  ==> PROT P ... done.
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done.  ==> CWD not needed.
==> SIZE test.zip ... 3269601
==> PASV ... done.    ==> RETR test.zip ... done.
Length: 3269601 (3.1M) (unauthoritative)
Segmentation fault

My wget was compiled with openssl 1.1.1i library.
And the segfault occured when resuming the SSL session for the data transfer. At this time, the session previously saved in ctx->sess is no more valid (it has been changed by the openssl lib). This is apparently a specific behavior in openssl when using TLS 1.3.

Here you are my patch for this issue in wget 1.21.3:

--- org/src/openssl.c 2022-03-03 11:19:09.513659802 +0100
+++ new/src/openssl.c 2022-03-03 11:29:48.870596212 +0100
@@ -825,6 +825,7 @@
     {
       /* attempt to resume a previous SSL session */
       ctx = (struct openssl_transport_context *) fd_transport_context (*continue_session);
+      ctx->sess = SSL_get0_session (ctx->conn);
       if (!ctx || !ctx->sess || !SSL_set_session (conn, ctx->sess))
         goto error;
     }

BurningZeRoad <burningzeroad>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by darnir (Updated the item)
  • -email is unavailable- added by burningzeroad (Submitted the item)
  •  

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-10-22 darnir StatusNone Ready for Merge
        Assigned toNone darnir
    2022-03-03 burningzeroad Attached File- Added wget-1.21.3-openssl-tls1.3-segfault.patch, #52954

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code