Bug #17737 yassl libmysqlclient crashes if no client certificate provided

Description:
YaSSL libmysqlclient crashes if no client-side certificate is provided:

(--ssl-ca argument is used as ssl certificate for server):

flute:~/Tests/yassl midom$ ./bin/mysql -S var/socket --ssl --ssl-ca=/Users/midom/Tests/yassl/certs/server.key
Bus error

Starting program: /Users/midom/Tests/yassl/bin/mysql -S var/socket --ssl --ssl-ca=/Users/midom/Tests/yassl/certs/server.key
Reading symbols for shared libraries .+ done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x00244d2d in yaSSL::x509::get_length (this=0x0) at cert_wrapper.cpp:77
77          return length_; 
(gdb) bt
#0  0x00244d2d in yaSSL::x509::get_length (this=0x0) at cert_wrapper.cpp:77
#1  0x00256944 in yaSSL::Certificate::Certificate (this=0xbfffed74, cert=0x0) at yassl_imp.cpp:980
#2  0x0024ccf5 in yaSSL::sendCertificate (ssl=@0x1809000, buffer=buffered) at handshake.cpp:955
#3  0x0024e757 in SSL_connect (ssl=0x1809000) at ssl.cpp:121
#4  0x0024eb46 in SSL_do_handshake (ssl=0x1809000) at ssl.cpp:205
#5  0x00240c87 in sslconnect (ptr=0x600a58, vio=0x6007e8, timeout=0) at viossl.c:375
#6  0x00239475 in mysql_real_connect (mysql=0x2e500, host=0x282298 "localhost", user=0x600448 "root", passwd=0x2819b0 "", db=0x0, port=0, unix_socket=0x600478 "var/socket", client_flag=241157) at client.c:2040
#7  0x000060f5 in sql_real_connect (host=0x0, database=0x0, user=0x600448 "root", password=0x0, silent=0) at mysql.cc:3076
#8  0x00006267 in sql_connect (host=0x0, database=0x0, user=0x600448 "root", password=0x0, silent=0) at mysql.cc:3111
#9  0x0000b58e in main (argc=6, argv=0x600528) at mysql.cc:409

(gdb) up    
#1  0x00256944 in yaSSL::Certificate::Certificate (this=0xbfffed74, cert=0x0) at yassl_imp.cpp:980
980         set_length(cert_->get_length() + 2 * CERT_HEADER); // list and cert size
(gdb) print *this
warning: RTTI symbol not found for class 'yaSSL::Certificate'
$1 = {
  <HandShakeBase> = {
    <virtual_base> = {<No data fields>}, 
    members of HandShakeBase: 
    _vptr$HandShakeBase = 0x2ba3e8, 
    length_ = 1634738284
  }, 
  members of Certificate: 
  cert_ = 0x0
}

How to repeat:
run mysql with yassl..

Suggested fix:
check for null certificates

Tested using a recent 5.0bk pull under 10.4.4

Magnus will review patch provided by Domas.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/3751

Patch sent to Todd and included in upstream yaSSL.

This problem will be fixed when the latest patch from upstream yaSSL have been pushed.

verified a crash on today's 5.0.22-bk on windows.  Connecting without ssl-key cause client to crash with stack trace:

mysql.exe!_NMSG_WRITE
mysql.exe!abort()
mysql.exe!_assert
mysql.exe!TaoCrypt::Block<unsigned char,TaoCrypt::AllocatorWithCleanup<unsigned char> >::operator[]
mysql.exe!TaoCrypt::Source::next()
mysql.exe!TaoCrypt::BER_Decoder::GetSequence()
mysql.exe!TaoCrypt::DSA_Private_Decoder::ReadHeader()
mysql.exe!TaoCrypt::DSA_Private_Decoder::Decode
mysql.exe!TaoCrypt::DSA_PrivateKey::Initialize
mysql.exe!yaSSL::DSS::DSSImpl::SetPrivate
mysql.exe!yaSSL::DSS::DSS
mysql.exe!yaSSL::CertificateVerify::Build
mysql.exe!yaSSL::sendCertificateVerify
mysql.exe!SSL_connect
mysql.exe!SSL_do_handshake
mysql.exe!_sslconnect()
mysql.exe!_mysql_real_connect@32()
mysql.exe!sql_real_connect
mysql.exe!sql_connect
mysql.exe!main
mysql.exe!mainCRTStartup()
kernel32.dll!ProcessIdToSessionId()

Probably the same bug, causes the *server* to crash when connecting from a JDBC client!!! Verified a server crash using the upload .java testcase.

server crash stack trace

Attachment: crash.stack.txt (text/plain), 4.13 KiB.

Upgraded our bundled yaSSL to latest version. This should fix this problem.

Noted in 5.0.22, 5.1.10 changelogs.

The bundled yaSSL library was upgraded to version 1.3.0. This
improves handling of certain problems with
SSL-related command options. (Bug #17737)

The server crash (as captured in the crash.stack.txt submitted by Shane) is apparently due to an alignment problem on machines with SSE2 capability (like those with Pentium 4 CPUs, for example).

The faulting instruction is MOVDQA, which is also known as _mm_load_si128. It loads a 16-byte-aligned integer into an MMX register.

I replaced the two _mm_load_si128 instructions with _mm_loadu_si128(also known as MOVDQU) which does an unaligned 16-byte move. This seemed to fix the problem.

This was reported to yassl who found it to be a flaw in the use of their aligned allocator. Hopefully the 1.3.0 version of yassl includes this fix.

I'd be happier if we had a separate bug report tracking the server crash, given that it's probably a P4-only problem and is on the server side.