[tor-bugs] #13471 [Tor]: router daemon crashes with openssl built no_ssl3

[Tor Bug Tracker & Wiki]

#13471: router daemon crashes with openssl built no_ssl3
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:
  starlight              |     Status:  new
         Type:  defect   |  Milestone:  Tor: 0.2.6.x-final
     Priority:  major    |    Version:  Tor: 0.2.4.24
    Component:  Tor      |   Keywords:  tor-relay ssl3 poodle 025-backport
   Resolution:           |  024-backport 023-backport
Actual Points:           |  Parent ID:
       Points:           |
-------------------------+-------------------------------------------------

Comment (by yawning):

 Replying to [comment:5 dgoulet]:
 > I tried with the provided configure options and couldn't reproduce it
 (on tor master branch).
 >
 > @starlight: can you provide the commit id or git tag of tor you used or
 package version ?

 Likewise, can't reproduce on master, or with an older copy of master that
 I'm fairly sure predates nickm's change.  However I can reproduce it on
 0.2.4.24, so here's the stacktrace.

 {{{
 Program received signal SIGSEGV, Segmentation fault.
 0x00005555556cfbcd in SSL_ctrl (s=0x55555777b6c0, cmd=55, larg=0,
 parg=0x0)
     at ssl_lib.c:1106
 1106                    return(s->method->ssl_ctrl(s,cmd,larg,parg));
 (gdb) bt
 #0  0x00005555556cfbcd in SSL_ctrl (s=0x55555777b6c0, cmd=55, larg=0,
 parg=0x0)
     at ssl_lib.c:1106
 #1  0x00005555556ba291 in tor_tls_free (tls=0x55555777b660)
     at src/common/tortls.c:2029
 #2  0x000055555563f701 in connection_free_
 (conn=conn at entry=0x55555777b080)
     at src/or/connection.c:512
 #3  0x00005555556400d3 in connection_free (conn=conn at entry=0x55555777b080)
     at src/or/connection.c:631
 #4  0x0000555555595555 in connection_unlink
 (conn=conn at entry=0x55555777b080)
     at src/or/main.c:414
 #5  0x00005555555961b4 in conn_close_if_marked (i=<optimized out>)
     at src/or/main.c:930
 #6  0x000055555559622a in close_closeable_connections () at
 src/or/main.c:699
 #7  0x0000555555596636 in conn_read_callback (fd=<optimized out>,
     event=<optimized out>, _conn=0x555555b3c980) at src/or/main.c:734
 #8  0x00007ffff7689104 in event_base_loop () from
 /usr/lib/libevent-2.0.so.5
 #9  0x0000555555597ae7 in do_main_loop () at src/or/main.c:1987
 #10 0x00005555555988a4 in tor_main (argc=3, argv=0x7fffffffe4e8)
     at src/or/main.c:2703
 #11 0x0000555555593249 in main (argc=<optimized out>, argv=<optimized
 out>)
     at src/or/tor_main.c:30
 (gdb) p s
 $1 = (SSL *) 0x55555777b6c0
 (gdb) p s->method
 $2 = (const SSL_METHOD *) 0x0
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13471#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online