whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SSL internals: fix memory corruption using QSslConfigurationPrivate 

We are passing a QSslConfigurationPrivate that is allocated on the stack
(in QSslSocketBackendPrivate::initSslContext()) to
QSslConfiguration::QSslConfiguration(QSslConfigurationPrivate *dd).
When the SSL context is destroyed, this object is not there any more.
So now we create a deep copy of the configuration like we do in
QSslSocket::sslConfiguration().

Task-number: QTBUG-30648
Change-Id: Iaefaa9c00fd6bfb707eba5ac59e9508bf951f8a5
Reviewed-by: Richard J. Moore <rich@kde.org>
bb10
Peter Hartmann 2013-04-17 17:42:32 +02:00 committed by The Qt Project
parent b3bed2c8de
commit 835e720c7e
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/network/ssl/qsslsocket_openssl.cpp
View File

@ -325,9 +325,13 @@ bool QSslSocketBackendPrivate::initSslContext()
Q_Q(QSslSocket);
// If no external context was set (e.g. bei QHttpNetworkConnection) we will create a default context
if (!sslContextPointer)
if (!sslContextPointer) {
// create a deep copy of our configuration
QSslConfigurationPrivate *configurationCopy = new QSslConfigurationPrivate(configuration);
configurationCopy->ref.store(0); // the QSslConfiguration constructor refs up
sslContextPointer = QSharedPointer<QSslContext>(
QSslContext::fromConfiguration(mode, QSslConfiguration(&configuration), allowRootCertOnDemandLoading));
QSslContext::fromConfiguration(mode, configurationCopy, allowRootCertOnDemandLoading));
}
if (sslContextPointer->error() != QSslError::NoError) {
q->setErrorString(sslContextPointer->errorString());