[release/7.0] Prevent use of null when processing ALPN list #81797
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones Issue DetailsBackport of #81629 to release/7.0 /cc @wfurt Customer ImpactTestingRiskIMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
|
|
Tagging subscribers to this area: @dotnet/ncl, @vcsjones Issue DetailsBackport of #81629 to release/7.0 /cc @wfurt Customer ImpactTestingRiskIMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
|
wfurt
added
Servicing-consider
carlossanlop
force-pushed
the
backport/pr-81629-to-release/7.0
branch
from
512159f
to
b414e32
Compare
|
@carlossanlop we should NOT push this into March release, let's do it next month. Thank you! |
|
Marking as 'blocked' to first gather more info about impact, workaround feasibility and finding root-cause -- see comments in the template above. |
karelz
changed the title
wfurt
added
Servicing-consider
|
two customers verified the mainline fix. |
|
@carlossanlop it is ready for Tactics consideration -- the fix has been verified by 2 customers (see updated template). |
carlossanlop
added
Servicing-approved
|
Approved by Tactics via email. |
ghost
locked as resolved and limited conversation to collaborators
Backport of #81629 to release/7.0
Fixes #81588
/cc @wfurt
Customer Impact
We can throw exception in our native callback we register in OpenSSL. OpenSSL cannot handle it, which leads to process crash.
It seems to be a rare condition - so far 2 customers hit it, (for one, happening once per 2 days). The impact is bad (a process crash).
The root cause is not yet fully understood. We need to look deeper into the dumps.
This is a band-aid fix ('null' check) to change crash into OpenSSL error code, which customer code can handle.
Testing
2 customers verified the fix on private 7.0 servicing bits in their environments - see confirmation and confirmation.
All functional tests are passing
Regression
Yes, this is a new code path in 7.0 which app written against 6.0 can hit.
Risk
Small