Bug#843988: stunnel4 segfaults (client mode)

[Sebastian Andrzej Siewior]

On 2016-11-11 16:05:05 [+0100], gregor herrmann wrote:
> As soon as fetchnews connects, stunnel4 segfaults.

I tried your config against a http server and mail server with no luck.

> The messages in the syslog:
> Nov 11 15:53:55 jadzia stunnel: LOG2[2]: Double free attempt: 
> ptr=0x7f6340010430 alloc=crypto/asn1/asn1_lib.c:277 free#1=str.c:200 
> free#2=crypto/asn1/asn1_lib.c:323
…
> Nov 11 15:53:55 jadzia stunnel: LOG2[3]: Double free attempt: 
> ptr=0x7f633800ff60 alloc=`..8c.:277 free#1=:200 
> free#2=crypto/asn1/asn1_lib.c:323
> Nov 11 15:53:55 jadzia stunnel: INTERNAL ERROR: Bad magic at 
> crypto/asn1/asn1_lib.c, line 323

based on this it seems that stunnel itself tries to free memory
allocated by openssl which it should not do. And this goes on until it
finds that is not a chunk but something completely different and then
goes boom.
Can you try the patch attached on stunnel, recompile it and check if it
still goes boom?

> Cheers,
> gregor

Sebastian

diff --git a/src/tls.c b/src/tls.c
index 3964f9ce6f2d..8b2b18938d74 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -100,6 +100,7 @@ void tls_cleanup() {
     tls_data=tls_get();
     if(!tls_data)
         return;
+    OPENSSL_thread_stop();
     str_cleanup(tls_data);
     str_free(tls_data->id); /* detached allocation */
     tls_set(NULL);