[openssl.org #291] race condition in *get_cipher_by_char

s2_lib.c:ssl2_get_cipher_by_char
s3_lib.c:ssl3_get_cipher_by_char

has this code:

    if (init)
        {
        CRYPTO_w_lock(CRYPTO_LOCK_SSL);
...[qsort and stuff]...
        CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
        init=0;
        }

There needs to be a "if (init)" after the lock is acquired to prevent the
static data from being trashed while another thread is using it.

Or, you can use an atomic set operation instead, if openssl has that
available:

    if (atomic_set(&init, 1) == 0) {
       // do init stuff

patrick


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]