Question

I am trying to connect as a client over SSL and am seeing some strange behavior.
I am getting an intermittent segmentation fault inside SSL_CTX_new when trying to create a new SSL context. It should also be noted that this is a fCGI demon, and only seems to have an issue when running as such. If I run it as a standalone cgi application, the issue seems to disappear.

Looking into the core file, this is what I see:

splint(??, ??) at 0xd03c36f4
malloc_y(0x4c, 0x0, 0x9e, 0x0, 0x20062240, 0x170, 0x0, 0x0) at 0xd03c5bcc
malloc_common_81_64(??) at 0xd03512b8
mem.default_malloc_ex() at 0xd0b0f784
CRYPTO_malloc_24_10() at 0xd0b101c8
ssl_cert.ssl_cert_new() at 0xd6f86084
ssl_lib.SSL_CTX_new() at 0xd6f83084

Has anyone run into something similar? A search of previous questions turned up some discussions of SSL_CTX_new returning NULL, but no reports of segmentation faults.

Here’s the function I’m using to create the new context:

SSL_CTX* newSSLContext(char* keyfile, char* password) {  
   SSL_METHOD *meth;  
   SSL_CTX *ctx;  
   if (!bio_err) {  
      SSL_library_init();  
      SSL_load_error_strings();  
      bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);  
   }  
   signal(SIGPIPE, sigpipe_handle);  
   meth = SSLv23_method();  
   ctx = SSL_CTX_new(meth);  
   if (!(SSL_CTX_use_certificate_chain_file(ctx, keyfile))) {  
      err("Can't read certificate file");  
      return NULL;  
   }  
   pass = password;  
   SSL_CTX_set_default_passwd_cb(ctx, password_cb);  
   if (!(SSL_CTX_use_PrivateKey_file(ctx, keyfile, SSL_FILETYPE_PEM))) {  
      err("Can't read key file");  
      return NULL;
   }  
   if (!(SSL_CTX_load_verify_locations(ctx, keyfile, 0))) {  
      err("Can't read CA list");  
      return NULL;  
   }  
   return ctx;  
}

Answer 1

Short of a good solution. I’ve resorted to switching to libcurl for my SSL needs. This seems to streamline the code I actually have to write.