moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-05 09:05:04 -05:00
Code Issues Releases Wiki Activity

ngtcp2: fix thread-safety bug in error-handling

Browse Source 
ERR_error_string(NULL) should never be called. It places the error in a
global buffer, which is not thread-safe. Use ERR_error_string_n with a
local buffer instead.

Closes #4645
This commit is contained in:
David Benjamin 2019-11-27 16:53:51 -05:00 committed by Daniel Stenberg
parent 113db127ee
commit d94aa39410
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/vquic/ngtcp2.c
View File

@ -256,8 +256,9 @@ static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data)
SSL_CTX_set_default_verify_paths(ssl_ctx);
if(SSL_CTX_set_ciphersuites(ssl_ctx, QUIC_CIPHERS) != 1) {
failf(data, "SSL_CTX_set_ciphersuites: %s",
ERR_error_string(ERR_get_error(), NULL));
char error_buffer[256];
ERR_error_string_n(ERR_get_error(), error_buffer, sizeof(error_buffer));
failf(data, "SSL_CTX_set_ciphersuites: %s", error_buffer);
return NULL;
}