Re: [tpop3d-discuss] ssl Bug

[Chris Lightfoot]

Can you try the attached patch (not yet in CVS). I believe
I've found the problem.

tpop3d uses ring buffers to avoid blocking reads and
writes. This is fine for reading, and for writing over an
unsecured TCP connection. But under TLS, when a call to
SSL_write (analogous to write(2)) returns a code
indicating that the write would block, it's necessary that
the next call to SSL_write is passed exactly the same
buffer, or an extended buffer.

The bug occurs when a call to SSL_write would block, and
the ring buffer is arranged so that the data to write
would get split across the end of the ring buffer:

    <-------- A -------->
    XXXXXXXXXXXXXXXXXXXXX                       <-- original data to write

    try immediate write:

    SSL_write(..., buf, A)      fails, would block

    save contents of buffer in ring buffer

   <--- C -->                       <---- B ---->
   ,--------------------------------------------.
   |XXXXXXXXX                       XXXXXXXXXXXX|
   `--------------------------------------------'
            ^                       ^ beginning of data


    SSL_write(..., ringbuf + ..., B)
                                fails, bad write retry

The attached patch makes the data in the ring buffer
contiguous. I haven't tested it much but it seems to do
the right thing.

-- 
``It is certainly going to deter the casual bomber.''
  (BBC correspondent Frank Gardner on the emplacement
  of concrete blocks around the Palace of Westminster)

tls-fix-candidate.patch
Description: Text document