1925505 - Thread safety of `firsttime` in `ssl_SetDefaultsFromEnvironment`

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[Maurice Dauer [:mdauer]]

firsttime is not guarded in any way, resulting in a race condition if multiple threads call ssl_SetDefaultsFromEnvironment at the same time: https://searchfox.org/mozilla-central/rev/e24f7f322960a39f9ef644a31b6026994db73850/security/nss/lib/ssl/sslsock.c#3912.

Interestingly, while searching for firsttime I came across a similar variant at nsSOCKSIOLayerAddToSocket, though I'm not sure if it is reachable by multiple threads simultaneously: https://searchfox.org/mozilla-central/rev/e24f7f322960a39f9ef644a31b6026994db73850/netwerk/socket/nsSOCKSIOLayer.cpp#1392.

Comment 1

[Maurice Dauer [:mdauer]]

Attachment: Bug 1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe, r?#nss-reviewers

Comment 2

[Maurice Dauer [:mdauer]]

https://hg.mozilla.org/projects/nss/rev/5f06d0a0fb705f30c057165bc3fbceb2e63ab5ec