tarantool / tarantool/tarantool
Using of inconsistent crypto functions
@sergepetrenko is already working on this.
Since May 29, 2026.
- Dominant language
- Lua
- Stars
- 3.7k
- Forks
- 419
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 88
Description
Bug description
Customer faced with a problem after updating that ended up with coredump. The problem arose when the customer have updated his tarantool-based product (tarantool version have been updated from 2.10.3 to 2.11.8 as a result).
It was discovered that crypto-functions from the different versions of openssl library are used, namely: EVP_sha1 from openssl 3+ (that is statically linked into tarantool 2.11.8) and EVP_DigestInit_ex from 1.1.1 (that is shared library that comes with odbc-driver used in the product).
Actual addresses of the functions from shared libraries are resolved at instance start (in fact lazy-binding mechanism is used that defers the resolution until the first call but it doesn't look like a big deal) and it turns out that it might be resolved into the static one of the same name so we get inconsistent using of library functions.
Considering this it looks like all functions from the statically linked libraries should be hidden to avoid such undesirable resolutions.
- OS: Any
- OS Version: Any
- Architecture: [amd64]
Tarantool Enterprise 2.11.8-0-g7beeb5ba4
Target: Linux-x86_64-RelWithDebInfo
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/builds/tarantool/delivery/sdk/build.sdk/tarantool-2.11/static-build/tarantool-prefix -DENABLE_BACKTRACE=TRUE
Compiler: GNU-9.3.1
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -static-libstdc++ -fno-common -fopenmp -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/builds/tarantool/delivery/sdk/tarantool-2.11=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -fno-gnu89-inline -Wno-cast-function-type
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -static-libstdc++ -fno-common -fopenmp -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/builds/tarantool/delivery/sdk/tarantool-2.11=. -std=c++17 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.