search

icing / mod_md

Let's Encrypt (ACME) in Apache httpd
https://icing.github.io/mod_md/
Apache License 2.0
334 stars 28 forks source link

Segmentation fault possible in `md_acme_order.c:check_challenges()` #324

Closed bitscher closed 10 months ago

bitscher commented 10 months ago

In function https://github.com/icing/mod_md/blob/1e105f8382513eab42653e64e4b2d7883441d7f6/src/md_acme_order.c#L497

Call to md_acme_authz_retrieve() can fail and authz will be set to NULL. Dereferencing it in the error handling will result in a segmentation fault.

https://github.com/icing/mod_md/blob/1e105f8382513eab42653e64e4b2d7883441d7f6/src/md_acme_order.c#L510-L511 https://github.com/icing/mod_md/blob/1e105f8382513eab42653e64e4b2d7883441d7f6/src/md_acme_order.c#L538-L542

icing commented 10 months ago

Thanks for the report! This indeed looks wrong. Please see #325 for a fix.

icing commented 10 months ago

release in v2.4.25