[audit][plugin-api] TSSslClientContextsNamesGet returns pointers into config-owned strings that dangle after SSL config reload
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
Research direction
Start in src/api/InkAPI.cc around TSSslClientContextsNamesGet at lines 8146-8166, then inspect its declaration and the TSSslSecretGet contract in ts.h. Verify the returned names' lifetime across SSL configuration reloads; done means the API no longer exposes dangling pointers and its ownership or lifetime contract is explicit and tested.
Written by the indexing model from the issue text.
Description
Severity: medium · Category: use-after-free
Location: src/api/InkAPI.cc:8159
What's wrong
The function fills the caller's result array with string_view::data() pointers taken from the keys of params->top_level_ctx_map, then immediately calls SSLConfig::release(params) and returns. The function keeps no reference on behalf of the caller: as soon as an ssl_multicert/records reload retires that SSLConfigParams generation and the last other reference drops, the std::string keys backing every returned const char* are destroyed, and the plugin holds dangling pointers. The API's documented usage pattern ('call TSSslClientContextsNamesGet first to determine which lookup keys are present before querying') encourages holding these pointers across calls, exactly the window in which a reload frees them. Nothing in ts.h or the function copies the names or warns about the lifetime.
Evidence
InkAPI.cc:8146-8166:
auto mem = static_cast<std::string_view *>(alloca(sizeof(std::string_view) * n));
...
for (int i = 0; i < idx; i++) {
result[i] = mem[i].data();
}
}
...
SSLConfig::release(params);
return TS_SUCCESS;
Suggested fix
Copy the names into TSmalloc'd storage the caller frees (matching TSSslSecretGet's contract), or document that the pointers are only valid until the next SSL configuration reload and provide a lifetime-safe variant.
Filed from an automated multi-lens codebase audit. Full report: CODEBASE_AUDIT.md / audit-report.html on branch claude/codebase-audit-review-9nw7vz.
- Dominant language
- C++
- Stars
- 0
- Forks
- 0
- Avg merge
- 8h 2m
- Merged PRs (30d)
- 21
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from JakeChampion/trafficserver
-
10.2 area:standards audit severity:low
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
10.2 area:plugin-api audit severity:medium
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
area:httpsm audit severity:medium
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
area:security audit severity:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
[10.2][hdrs] obs-fold continuation silently dropped when CRLF lands on an input-buffer boundary Open10.2 area:hdrs audit severity:medium
Difficulty 4/5 3-5 days Newbie friendliness 48/100
All issues in JakeChampion/trafficserver
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Sensor initialization takes very long when `--initial-sim-time` is set to current UNIX timestamp Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
gazebosim/gz-sensors#662 · 1 comment ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
LadybirdBrowser/ladybird#12123 ·