tree ffda1ebffa54d5a49193bddad872e9a91a9c5b6b
parent 15dc0e2a1cf2d5f637c5ec92100104a4d6782601
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1673262162 +0100
committer William Lallemand <wlallemand@haproxy.org> 1673275421 +0100

BUG/MINOR: ssl: Crash during cleanup because of ocsp structure pointer UAF

When ocsp-update is enabled for a given certificate, its
certificate_ocsp objects is inserted in two separate trees (the actual
ocsp response one and the ocsp update one). But since the same instance
is used for the two trees, its ownership is kept by the regular ocsp
response one. The ocsp update task should then never have to free the
ocsp entries. The crash actually occurred because of this. The update
task was freeing entries whose reference counter was not increased while
a reference was still held by the SSL_CTXs.
The only time during which the ocsp update task will need to increase
the reference counter is during an actual update, because at this moment
the entry is taken out of the update tree and a 'flying' reference to
the certificate_ocsp is kept in the ocsp update context.

This bug could be reproduced by calling './haproxy -f conf.cfg -c' with
any of the used certificates having the 'ocsp-update on' option. For
some reason asan caught the bug easily but valgrind did not.

This patch does not need to be backported.