avast / authenticode-parser

Authenticode-parser is a simple C library for Authenticode format parsing using OpenSSL.
MIT License
16 stars 8 forks source link

Get rid of race condition in multithreaded environment #5

Closed HoundThe closed 2 years ago

HoundThe commented 2 years ago

Due to the way OBJ_create works in openssl 1.1.1 https://github.com/openssl/openssl/issues/13524 we can get to a double-free situation in a multithreaded environment. This requires the library user to invoke initialize_authenticode_parser() himself before any multithreaded environment as the library needs the global openssl objects initialized to work.