[PATCH v3 1/2] secur32: Fix race between schan_(Encrypt|Decrypt)Message
Anton Romanov
theli.ua at gmail.com
Fri Sep 15 01:01:05 CDT 2017
MSDN states that it's supposed to be thread safe.
Fixes https://bugs.winehq.org/show_bug.cgi?id=43453
Signed-off-by: Anton Romanov <theli.ua at gmail.com>
---
dlls/secur32/schannel.c | 36 ++++++++++++++----------------------
1 file changed, 14 insertions(+), 22 deletions(-)
diff --git a/dlls/secur32/schannel.c b/dlls/secur32/schannel.c
index 82374efd55..ed717bb41e 100644
--- a/dlls/secur32/schannel.c
+++ b/dlls/secur32/schannel.c
@@ -57,6 +57,7 @@ struct schan_handle
struct schan_context
{
schan_imp_session session;
+ struct schan_transport transport;
ULONG req_ctx_attr;
const CERT_CONTEXT *cert;
};
@@ -789,7 +790,6 @@ static SECURITY_STATUS SEC_ENTRY schan_InitializeSecurityContextW(
struct schan_context *ctx;
struct schan_buffers *out_buffers;
struct schan_credentials *cred;
- struct schan_transport transport;
SIZE_T expected_size = ~0UL;
SECURITY_STATUS ret;
@@ -891,24 +891,24 @@ static SECURITY_STATUS SEC_ENTRY schan_InitializeSecurityContextW(
ctx->req_ctx_attr = fContextReq;
- transport.ctx = ctx;
- init_schan_buffers(&transport.in, pInput, schan_init_sec_ctx_get_next_input_buffer);
- transport.in.limit = expected_size;
- init_schan_buffers(&transport.out, pOutput, schan_init_sec_ctx_get_next_output_buffer);
- schan_imp_set_session_transport(ctx->session, &transport);
+ ctx->transport.ctx = ctx;
+ init_schan_buffers(&ctx->transport.in, pInput, schan_init_sec_ctx_get_next_input_buffer);
+ ctx->transport.in.limit = expected_size;
+ init_schan_buffers(&ctx->transport.out, pOutput, schan_init_sec_ctx_get_next_output_buffer);
+ schan_imp_set_session_transport(ctx->session, &ctx->transport);
/* Perform the TLS handshake */
ret = schan_imp_handshake(ctx->session);
- if(transport.in.offset && transport.in.offset != pInput->pBuffers[0].cbBuffer) {
+ if(ctx->transport.in.offset && ctx->transport.in.offset != pInput->pBuffers[0].cbBuffer) {
if(pInput->cBuffers<2 || pInput->pBuffers[1].BufferType!=SECBUFFER_EMPTY)
return SEC_E_INVALID_TOKEN;
pInput->pBuffers[1].BufferType = SECBUFFER_EXTRA;
- pInput->pBuffers[1].cbBuffer = pInput->pBuffers[0].cbBuffer-transport.in.offset;
+ pInput->pBuffers[1].cbBuffer = pInput->pBuffers[0].cbBuffer-ctx->transport.in.offset;
}
- out_buffers = &transport.out;
+ out_buffers = &ctx->transport.out;
if (out_buffers->current_buffer_idx != -1)
{
SecBuffer *buffer = &out_buffers->desc->pBuffers[out_buffers->current_buffer_idx];
@@ -1205,7 +1205,6 @@ static int schan_encrypt_message_get_next_buffer_token(const struct schan_transp
static SECURITY_STATUS SEC_ENTRY schan_EncryptMessage(PCtxtHandle context_handle,
ULONG quality, PSecBufferDesc message, ULONG message_seq_no)
{
- struct schan_transport transport;
struct schan_context *ctx;
struct schan_buffers *b;
SECURITY_STATUS status;
@@ -1235,13 +1234,10 @@ static SECURITY_STATUS SEC_ENTRY schan_EncryptMessage(PCtxtHandle context_handle
data = HeapAlloc(GetProcessHeap(), 0, data_size);
memcpy(data, buffer->pvBuffer, data_size);
- transport.ctx = ctx;
- init_schan_buffers(&transport.in, NULL, NULL);
if (schan_find_sec_buffer_idx(message, 0, SECBUFFER_STREAM_HEADER) != -1)
- init_schan_buffers(&transport.out, message, schan_encrypt_message_get_next_buffer);
+ init_schan_buffers(&ctx->transport.out, message, schan_encrypt_message_get_next_buffer);
else
- init_schan_buffers(&transport.out, message, schan_encrypt_message_get_next_buffer_token);
- schan_imp_set_session_transport(ctx->session, &transport);
+ init_schan_buffers(&ctx->transport.out, message, schan_encrypt_message_get_next_buffer_token);
length = data_size;
status = schan_imp_send(ctx->session, data, &length);
@@ -1251,7 +1247,7 @@ static SECURITY_STATUS SEC_ENTRY schan_EncryptMessage(PCtxtHandle context_handle
if (length != data_size)
status = SEC_E_INTERNAL_ERROR;
- b = &transport.out;
+ b = &ctx->transport.out;
b->desc->pBuffers[b->current_buffer_idx].cbBuffer = b->offset;
HeapFree(GetProcessHeap(), 0, data);
@@ -1327,7 +1323,6 @@ static void schan_decrypt_fill_buffer(PSecBufferDesc message, ULONG buffer_type,
static SECURITY_STATUS SEC_ENTRY schan_DecryptMessage(PCtxtHandle context_handle,
PSecBufferDesc message, ULONG message_seq_no, PULONG quality)
{
- struct schan_transport transport;
struct schan_context *ctx;
SecBuffer *buffer;
SIZE_T data_size;
@@ -1371,11 +1366,8 @@ static SECURITY_STATUS SEC_ENTRY schan_DecryptMessage(PCtxtHandle context_handle
data_size = expected_size - 5;
data = HeapAlloc(GetProcessHeap(), 0, data_size);
- transport.ctx = ctx;
- init_schan_buffers(&transport.in, message, schan_decrypt_message_get_next_buffer);
- transport.in.limit = expected_size;
- init_schan_buffers(&transport.out, NULL, NULL);
- schan_imp_set_session_transport(ctx->session, &transport);
+ init_schan_buffers(&ctx->transport.in, message, schan_decrypt_message_get_next_buffer);
+ ctx->transport.in.limit = expected_size;
while (received < data_size)
{
--
2.11.0
More information about the wine-patches
mailing list