A bug in some older versions of OpenSSL will cause a crash

in SSL_get_certificate for servers where the certificate hasn't
been sent.

Workaround by setting the ssl structure to client mode which
bypasses the faulty code in OpenSSL. Normally setting a server
ssl structure to client mode would cause problems later on:
but we are freeing the structure immediately without attempting
to use it.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1576741 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index b6b860d4f584ccded496866c0de0723aa0470f26..ed29b7fe0dd8b294e15d2a210a00dbbe9ecb0f9f 100644 (file)
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -964,8 +964,13 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
          */
         if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) {
 #else
-        if (!(ssl = SSL_new(mctx->ssl_ctx)) ||
-            !(cert = SSL_get_certificate(ssl))) {
+        ssl = SSL_new(mctx->ssl_ctx);
+       if (ssl) {
+            /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */
+            SSL_set_connect_state(ssl);
+            cert = SSL_get_certificate(ssl);
+        }
+        if (!ssl || !cert) {
 #endif
             ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566)
                          "Unable to retrieve certificate %s", key_id);