BIO_do_accept Issue

[Viktor Dukhovni]

On Wed, Apr 08, 2020 at 11:47:19AM +0100, Scott Morgan via openssl-users wrote:

> Run into an odd issue.
> 
> Consider the following program, based on the documentation[0], using
> OpenSSL 1.1.1f
> 
> 	abio = BIO_new_accept("4444");
> 	res = BIO_do_accept(abio);

It seems to me that since commit 417be660e1c BIO_do_accept() has
incomplete error handling, "ret" isn't assigned when bind() or listen()
fail:

    acpt_state(), crypto/bio//bss_acpt.c: line 241:

        case ACPT_S_LISTEN:
            {
                if (!BIO_listen(c->accept_sock,
                                BIO_ADDRINFO_address(c->addr_iter),
                                c->bind_mode)) {
                    BIO_closesocket(c->accept_sock);
                    goto exit_loop;
                }
            }

    ...
      exit_loop:
        if (bio != NULL)
            BIO_free(bio);
        else if (s >= 0)
            BIO_closesocket(s);
      end:
        return ret;

So the function returns the wrong value of ret, in your case the the
socket descriptor created in an earlier case in the loop.  The fix is
presumably to set ret to either -1 or 0, whichever is appropriate here.

-- 
    Viktor.