Wednesday, March 02, 2022

Re: [UPDATE] security/stunnel to 5.62

Hello,

I have managed to make stunnel build against libressl.

While working on it, i've triggered a segfault:

openbsd-arm64$ stunnel
Segmentation fault (core dumped)
openbsd-arm64$

...
So looked at the coredump to find clues:

Program received signal SIGSEGV, Segmentation fault.
prng_init (global=0xfb13b5ce8 <new_global_options>)
at /usr/ports/pobj/stunnel-5.62/stunnel-5.62/src/ssl.c:357
357 if(meth->status==NULL || meth->add==NULL) {
(gdb)

Breakpoint 5, prng_init (global=0x8c4385ce8 <new_global_options>)
at /usr/ports/pobj/stunnel-5.62/stunnel-5.62/src/ssl.c:354
354 const RAND_METHOD *meth=RAND_get_rand_method();

It has been fixed by wrapping the code path with
!defined(LIBRESSL_VERSION_NUMBER), RAND_*_rand_method() exist just for
ABI compatibility, the code fallback to "/dev/urandom" afterwards, but
would be great to use arc4random(3) instead, something like our
RAND_pseudo_bytes().

It builds and runs, been slighttly tested though, i don't have a fancy
setup so tests welcome.diff inline below

No comments:

Post a Comment