You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by re...@apache.org on 2026/10/16 15:03:53 UTC
(tomcat) 09/24: Check for NULL after SSL_CTX_new() and SSL_new() in the OpenSSL FFM code
This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit e4f0eec3ee8a49ce64cf85dd7e6fed4d30d9429d
Author: opencode <re...@apache.org>
AuthorDate: Fri Oct 16 10:59:05 2026 +0200
Check for NULL after SSL_CTX_new() and SSL_new() in the OpenSSL FFM code
The SSL context and SSL object returned by SSL_CTX_new() and SSL_new()
are passed directly to subsequent OpenSSL calls. Those calls dereference
their arguments natively, so if an allocation failed, for example under
memory exhaustion, the JVM would crash with a SIGSEGV instead of
reporting an error.
Check the result of each call in the panama OpenSSLContext constructor,
the panama OpenSSLEngine constructor and OpenSSLLibrary.findCiphers()
and throw an exception carrying the OpenSSL error queue content when
NULL is returned. The findCiphers() failures are reported by the
existing handling for that method: a logged warning and an empty cipher
list. In addition, reject a NULL SSL context segment in the engine
constructor, matching the check the JNI implementation performs.
The JNI/tomcat-native implementation effectively performs the same
checks: its native allocation helpers throw a Java exception when the
underlying OpenSSL allocation returns NULL.
---
.../apache/tomcat/util/net/openssl/panama/LocalStrings.properties | 2 ++
java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java | 3 +++
java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 5 ++++-
java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java | 6 ++++++
4 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties b/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties
index cec66550e9..77a6c27697 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties
+++ b/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties
@@ -32,6 +32,7 @@ engine.invalidBufferArray=offset: [{0}], length: [{1}] (expected: offset <= offs
engine.invalidDestinationBuffersState=The state of the destination buffers changed concurrently while unwrapping bytes
engine.invalidOCSPURL=The OCSP URL is invalid: [{0}]
engine.noRestrictSessionCreation=OpenSslEngine does not permit restricting the engine to only resuming existing sessions
+engine.noSSL=Could not create the SSL object [{0}]
engine.noSSLContext=No SSL context
engine.noSSLState=No state was found in the SSL Engine for the given SSL instance [{0}]
engine.nullBuffer=Null buffer
@@ -58,6 +59,7 @@ openssl.doubleInit=SSL context already initialized, ignoring
openssl.errApplyConf=Could not apply OpenSSLConf to SSL context
openssl.errCheckConf=Error during OpenSSLConf check
openssl.errMakeConf=Could not create OpenSSLConf context [{0}]
+openssl.errMakeContext=Could not create SSL context [{0}]
openssl.errorAddingCertificate=Error adding certificate to chain: [{0}]
openssl.errorConfiguringLocations=Error configuring CA certificate locations: [{0}]
openssl.errorInit=Non fatal error initializing certificates or configuration: [{0}]
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
index 856b516258..d093bba4d7 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
@@ -194,6 +194,9 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext {
// SSL protocol
sslCtx = SSL_CTX_new(clientMode ? TLS_client_method() : TLS_server_method());
+ if (MemorySegment.NULL.equals(sslCtx)) {
+ throw new SSLException(sm.getString("openssl.errMakeContext", OpenSSLLibrary.getLastError()));
+ }
int protocol = SSL_PROTOCOL_NONE;
for (String enabledProtocol : sslHostConfig.getEnabledProtocols()) {
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index 5109c42b9a..34ea6b65b5 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -188,13 +188,16 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn
OpenSSLSessionContext sessionContext, boolean alpn, boolean initialized, int certificateVerificationDepth,
boolean certificateVerificationOptionalNoCA, boolean noOcspCheck, boolean ocspSoftFail, int ocspTimeout,
int ocspVerifyFlags) {
- if (sslCtx == null) {
+ if (sslCtx == null || MemorySegment.NULL.equals(sslCtx)) {
throw new IllegalArgumentException(sm.getString("engine.noSSLContext"));
}
engineArena = Arena.ofAuto();
bufSegment = engineArena.allocate(MAX_ENCRYPTED_PACKET_LENGTH);
session = new OpenSSLSession();
var ssl = SSL_new(sslCtx);
+ if (MemorySegment.NULL.equals(ssl)) {
+ throw new IllegalStateException(sm.getString("engine.noSSL", OpenSSLLibrary.getLastError()));
+ }
// Set ssl_info_callback
SSL_set_info_callback(ssl, SSL_set_info_callback$cb.allocate(new InfoCallback(), engineArena));
if (clientMode) {
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java
index 2aa6c6addf..60b52bf407 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java
@@ -447,10 +447,16 @@ public class OpenSSLLibrary {
try (var localArena = Arena.ofConfined()) {
initLibrary();
var sslCtx = SSL_CTX_new(TLS_server_method());
+ if (MemorySegment.NULL.equals(sslCtx)) {
+ throw new IllegalStateException(sm.getString("openssl.errMakeContext", getLastError()));
+ }
try {
openssl_h_Compatibility.SSL_CTX_set_options(sslCtx, SSL_OP_ALL());
SSL_CTX_set_cipher_list(sslCtx, localArena.allocateFrom(ciphers));
var ssl = SSL_new(sslCtx);
+ if (MemorySegment.NULL.equals(ssl)) {
+ throw new IllegalStateException(sm.getString("engine.noSSL", getLastError()));
+ }
SSL_set_accept_state(ssl);
try {
for (String c : getCiphers(ssl)) {
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org