From c7638d93b0a2f24be7342fa9f902dab835dc837b Mon Sep 17 00:00:00 2001 From: Tatsuhiro Tsujikawa Date: Wed, 21 May 2014 23:34:55 +0900 Subject: openssl: Fix uninitialized variable use in NPN callback OpenSSL passes out and outlen variable uninitialized to select_next_proto_cb callback function. If the callback function returns SSL_TLSEXT_ERR_OK, the caller assumes the callback filled values in out and outlen and processes as such. Previously, if there is no overlap in protocol lists, curl code does not fill any values in these variables and returns SSL_TLSEXT_ERR_OK, which means we are triggering undefined behavior. valgrind warns this. This patch fixes this issue by fallback to HTTP/1.1 if there is no overlap. --- lib/vtls/openssl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c index 68c10678a..0e9c8f0bd 100644 --- a/lib/vtls/openssl.c +++ b/lib/vtls/openssl.c @@ -1440,7 +1440,11 @@ select_next_proto_cb(SSL *ssl, conn->negnpn = NPN_HTTP1_1; } else { - infof(conn->data, "NPN, no overlap, negotiated nothing\n"); + infof(conn->data, "NPN, no overlap, use HTTP1.1\n", + NGHTTP2_PROTO_VERSION_ID); + *out = (unsigned char*)"http/1.1"; + *outlen = sizeof("http/1.1") - 1; + conn->negnpn = NPN_HTTP1_1; } return SSL_TLSEXT_ERR_OK; -- cgit v1.2.3