-
Notifications
You must be signed in to change notification settings - Fork 847
Description
Hi,
Function SSL_write() returns the value of 0 and less than 0 are both on error. However , the return value of function SSL_write() is not checked correctly, which forgot to check the return value 0. See the following code:
line : 1098, 1101
trafficserver/tools/http_load/http_load.c
Lines 1097 to 1106 in 5ee6a5f
| if (urls[url_num].protocol == PROTO_HTTPS) | |
| r = SSL_write(connections[cnum].ssl, urls[url_num].buf, urls[url_num].buf_bytes); | |
| else | |
| r = write(connections[cnum].conn_fd, urls[url_num].buf, urls[url_num].buf_bytes); | |
| if (r < 0) { | |
| perror(urls[url_num].url_str); | |
| connections[cnum].reusable = 0; | |
| close_connection(cnum); | |
| return; | |
| } |
The same situation is also occured on line 1216, 1219
trafficserver/tools/http_load/http_load.c
Lines 1215 to 1224 in 5ee6a5f
| if (urls[url_num].protocol == PROTO_HTTPS) | |
| r = SSL_write(connections[cnum].ssl, urls[url_num].buf, urls[url_num].buf_bytes); | |
| else | |
| r = write(connections[cnum].conn_fd, urls[url_num].buf, urls[url_num].buf_bytes); | |
| if (r < 0) { | |
| perror(urls[url_num].url_str); | |
| connections[cnum].reusable = 0; | |
| close_connection(cnum); | |
| return; | |
| } |
===============================================================================
We find the return value of this call been checked in openssl project with the version of openssl 1.1.2.
Such as in openssl/apps folder
line 231: if (buf_len <= 0 || SSL_write(scon, buf, buf_len) <= 0)
line 232: goto end;Chi Li, Zuxing Gu, Jiecheng Wu