poco
poco copied to clipboard
Fixed incorrect SSL_CTX_set0_tmp_dh_pkey() usage
This simple program crashes POCO (tested under Red Hat Enterprise Linux 9.4):
#include <Poco/Net/Context.h>
int main()
{
const Poco::Net::Context context(Poco::Net::Context::CLIENT_USE, "/tmp", Poco::Net::Context::VERIFY_STRICT, 9, false, "ALL");
return 0;
}
The problem is an incorrect usage of SSL_CTX_set0_tmp_dh_pkey() in Context::initDH(). The return value is not evaluated and the key is freed even if it has been successfully transferred to the SSL Context.
The relevant part of the OpenSSL manpage https://docs.openssl.org/3.1/man3/SSL_CTX_set_tmp_dh_callback/:
Ownership of the dhpkey value is passed to the SSL_CTX or SSL object as a result of this call, and so the caller should not free it if the function call is successful.