https://bz.apache.org/bugzilla/show_bug.cgi?id=70222
Bug ID: 70222
Summary: mod_ssl_ct: unchecked calloc() return dereferenced in
ssl_ct_proxy_post_handshake() -- NULL pointer crash
under memory pressure
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: mod_ssl
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
modules/ssl/mod_ssl_ct.c, ssl_ct_proxy_post_handshake() (trunk HEAD as of
commit 8983e3a2ce16a5ae2f2ccb6898857d481c5a1e7b, 2026-09-17):
if (!cached) {
ct_cached_server_data *new_server_data =
(ct_cached_server_data *)calloc(1, sizeof(ct_cached_server_data));
new_server_data->validation_result =
rv = validate_server_data(p, c, conncfg->certs, conncfg, sconf);
...
calloc()'s return value is never checked before being dereferenced on the very
next line. If calloc() returns NULL (allocation failure, e.g. under memory
pressure), this is an immediate NULL pointer dereference / crash (CWE-476).
This code path runs during TLS handshake post-processing when httpd is acting
as a TLS proxy with mod_ssl_ct (Certificate Transparency, RFC 6962) enabled.
Verified by reading the full function end to end (lines ~2160-2240); confirmed
no NULL check exists anywhere on this path, and no earlier code guards this
specific pointer. Not reproduced live (would need a build with mod_ssl_ct
enabled and a way to force calloc() to fail on demand, e.g. malloc-failure
injection) -- reported as a static-analysis finding, not a live crash
reproduction.
Note: mod_ssl_ct is registered as an opt-in module (config.m4:
APACHE_MODULE(ssl_ct, ..., no, ...)), not built by default, and this calloc()
is small/fixed-size so only genuine system-wide memory exhaustion would trigger
it -- flagging for correctness/robustness rather than claiming high real-world
severity.
Suggested fix (sketch, not a verified patch -- exact brace placement needs
checking against the live file):
ct_cached_server_data *new_server_data =
(ct_cached_server_data *)calloc(1, sizeof(ct_cached_server_data));
+ if (new_server_data == NULL) {
+ validation_error = 1;
+ rv = APR_ENOMEM;
+ } else {
new_server_data->validation_result =
rv = validate_server_data(p, c, conncfg->certs, conncfg, sconf);
...
+ }
Found via static analysis (a custom tree-sitter-based C/C++ scanner) while
sweeping Internet Bug Bounty-eligible targets.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
