This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 27c4a150671fce4885fefd9ab07e0d4a5ca1fcef Author: opencode <[email protected]> AuthorDate: Fri Oct 16 10:59:05 2026 +0200 Check for NULL after SSL_CTX_new() and SSL_new() in the OpenSSL FFM code The SSL context and SSL object returned by SSL_CTX_new() and SSL_new() are passed directly to subsequent OpenSSL calls. Those calls dereference their arguments natively, so if an allocation failed, for example under memory exhaustion, the JVM would crash with a SIGSEGV instead of reporting an error. Check the result of each call in the panama OpenSSLContext constructor, the panama OpenSSLEngine constructor and OpenSSLLibrary.findCiphers() and throw an exception carrying the OpenSSL error queue content when NULL is returned. The findCiphers() failures are reported by the existing handling for that method: a logged warning and an empty cipher list. In addition, reject a NULL SSL context segment in the engine constructor, matching the check the JNI implementation performs. The JNI/tomcat-native implementation effectively performs the same checks: its native allocation helpers throw a Java exception when the underlying OpenSSL allocation returns NULL. --- .../apache/tomcat/util/net/openssl/panama/LocalStrings.properties | 2 ++ java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java | 3 +++ java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 5 ++++- java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java | 6 ++++++ 4 files changed, 15 insertions(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties b/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties index bd73d69ba2..76ea57c54a 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties +++ b/java/org/apache/tomcat/util/net/openssl/panama/LocalStrings.properties @@ -27,6 +27,7 @@ engine.invalidBufferArray=offset: [{0}], length: [{1}] (expected: offset <= offs engine.invalidDestinationBuffersState=The state of the destination buffers changed concurrently while unwrapping bytes engine.invalidOCSPURL=The OCSP URL is invalid: [{0}] engine.noRestrictSessionCreation=OpenSslEngine does not permit restricting the engine to only resuming existing sessions +engine.noSSL=Could not create the SSL object [{0}] engine.noSSLContext=No SSL context engine.noSSLState=No state was found in the SSL Engine for the given SSL instance [{0}] engine.noSession=SSL session ID not available @@ -54,6 +55,7 @@ openssl.doubleInit=SSL context already initialized, ignoring openssl.errApplyConf=Could not apply OpenSSLConf to SSL context openssl.errCheckConf=Error during OpenSSLConf check openssl.errMakeConf=Could not create OpenSSLConf context [{0}] +openssl.errMakeContext=Could not create SSL context [{0}] openssl.errorAddingCertificate=Error adding certificate to chain: [{0}] openssl.errorConfiguringLocations=Error configuring CA certificate locations: [{0}] openssl.errorInit=Non fatal error initializing certificates or configuration: [{0}] diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java index 88a99ce4ae..83ba29c94c 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java @@ -189,6 +189,9 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { // SSL protocol sslCtx = SSL_CTX_new(TLS_server_method()); + if (MemorySegment.NULL.equals(sslCtx)) { + throw new SSLException(sm.getString("openssl.errMakeContext", OpenSSLLibrary.getLastError())); + } int protocol = SSL_PROTOCOL_NONE; for (String enabledProtocol : sslHostConfig.getEnabledProtocols()) { diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index ad6bce7d23..5e8fae0d29 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -188,13 +188,16 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn OpenSSLSessionContext sessionContext, boolean alpn, boolean initialized, int certificateVerificationDepth, boolean certificateVerificationOptionalNoCA, boolean noOcspCheck, boolean ocspSoftFail, int ocspTimeout, int ocspVerifyFlags) { - if (sslCtx == null) { + if (sslCtx == null || MemorySegment.NULL.equals(sslCtx)) { throw new IllegalArgumentException(sm.getString("engine.noSSLContext")); } engineArena = Arena.ofAuto(); bufSegment = engineArena.allocate(MAX_ENCRYPTED_PACKET_LENGTH); session = new OpenSSLSession(); var ssl = SSL_new(sslCtx); + if (MemorySegment.NULL.equals(ssl)) { + throw new IllegalStateException(sm.getString("engine.noSSL", OpenSSLLibrary.getLastError())); + } // Set ssl_info_callback SSL_set_info_callback(ssl, SSL_set_info_callback$cb.allocate(new InfoCallback(), engineArena)); if (clientMode) { diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java index cac10c2a89..c969385848 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java @@ -445,10 +445,16 @@ public class OpenSSLLibrary { try (var localArena = Arena.ofConfined()) { initLibrary(); var sslCtx = SSL_CTX_new(TLS_server_method()); + if (MemorySegment.NULL.equals(sslCtx)) { + throw new IllegalStateException(sm.getString("openssl.errMakeContext", getLastError())); + } try { openssl_h_Compatibility.SSL_CTX_set_options(sslCtx, SSL_OP_ALL()); SSL_CTX_set_cipher_list(sslCtx, localArena.allocateFrom(ciphers)); var ssl = SSL_new(sslCtx); + if (MemorySegment.NULL.equals(ssl)) { + throw new IllegalStateException(sm.getString("engine.noSSL", getLastError())); + } SSL_set_accept_state(ssl); try { for (String c : getCiphers(ssl)) { --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
