Commit e808366
src: turn SSL_CTX_new CHECK/segfault into JS exception
These operations do not usually fail, but can do so when OpenSSL
is not configured properly (I ran into this while dynamically linking
against OpenSSL with FIPS). JS exceptions are way more useful
than CHECK failures or plain segfaults.
PR-URL: #42799
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 60e461c commit e808366
2 files changed
Lines changed: 9 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -197,10 +197,14 @@ void CipherBase::GetSSLCiphers(const FunctionCallbackInfo<Value>& args) { | |||
| 197 | 197 | Environment* env = Environment::GetCurrent(args); | |
| 198 | 198 | ||
| 199 | 199 | SSLCtxPointer ctx(SSL_CTX_new(TLS_method())); | |
| 200 | - CHECK(ctx); | ||
| 200 | + if (!ctx) { | ||
| 201 | + return ThrowCryptoError(env, ERR_get_error(), "SSL_CTX_new"); | ||
| 202 | + } | ||
| 201 | 203 | ||
| 202 | 204 | SSLPointer ssl(SSL_new(ctx.get())); | |
| 203 | - CHECK(ssl); | ||
| 205 | + if (!ssl) { | ||
| 206 | + return ThrowCryptoError(env, ERR_get_error(), "SSL_new"); | ||
| 207 | + } | ||
| 204 | 208 | ||
| 205 | 209 | STACK_OF(SSL_CIPHER)* ciphers = SSL_get_ciphers(ssl.get()); | |
| 206 | 210 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -508,6 +508,9 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) { | |||
| 508 | 508 | } | |
| 509 | 509 | ||
| 510 | 510 | sc->ctx_.reset(SSL_CTX_new(method)); | |
| 511 | + if (!sc->ctx_) { | ||
| 512 | + return ThrowCryptoError(env, ERR_get_error(), "SSL_CTX_new"); | ||
| 513 | + } | ||
| 511 | 514 | SSL_CTX_set_app_data(sc->ctx_.get(), sc); | |
| 512 | 515 | ||
| 513 | 516 | // Disable SSLv2 in the case when method == TLS_method() and the | |
0 commit comments