From 82e9b78a388ab539c8784cd853adf6e4a97d52c5 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Sat, 24 Apr 2010 23:21:13 +0200 Subject: nss: fix SSL handshake timeout underflow --- CHANGES | 3 +++ RELEASE-NOTES | 1 + lib/nss.c | 10 +++++++++- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index 3e2869c20..01856fe6a 100644 --- a/CHANGES +++ b/CHANGES @@ -14,6 +14,9 @@ Kamil Dudka (24 Apr 2010) - Fixed test536 in order to not fail with threaded DNS resolver and tweaked comments in certain examples using curl_multi_fdset(). +- Fixed SSL handshake timeout underflow in libcurl-NSS, which caused test405 + to hang on a slow machine. + Daniel Stenberg (21 Apr 2010) - The -O option caused curl to crash on windows and DOS due to the tool writing out of boundary memory. diff --git a/RELEASE-NOTES b/RELEASE-NOTES index 742184d30..24b809327 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -20,6 +20,7 @@ This release includes the following bugfixes: o -J/--remote-header-name strips CRLF o MSVC makefiles now use ws2_32.lib instead of wsock32.lib o -O crash on windows + o SSL handshake timeout underflow in libcurl-NSS This release includes the following known bugs: diff --git a/lib/nss.c b/lib/nss.c index 0f8ebd527..addb94b64 100644 --- a/lib/nss.c +++ b/lib/nss.c @@ -1025,6 +1025,7 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) int curlerr; const int *cipher_to_enable; PRSocketOptionData sock_opt; + long time_left; PRUint32 timeout; curlerr = CURLE_SSL_CONNECT_ERROR; @@ -1302,8 +1303,15 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) SSL_SetURL(connssl->handle, conn->host.name); + /* check timeout situation */ + time_left = Curl_timeleft(conn, NULL, TRUE); + if(time_left < 0L) { + failf(data, "timed out before SSL handshake"); + goto error; + } + timeout = PR_MillisecondsToInterval((PRUint32) time_left); + /* Force the handshake now */ - timeout = PR_MillisecondsToInterval((PRUint32)Curl_timeleft(conn, NULL, TRUE)); if(SSL_ForceHandshakeWithTimeout(connssl->handle, timeout) != SECSuccess) { if(conn->data->set.ssl.certverifyresult == SSL_ERROR_BAD_CERT_DOMAIN) curlerr = CURLE_PEER_FAILED_VERIFICATION; -- cgit v1.2.3