[openssl-dev] About multi-thread unsafe for APIs defined in crypto/objects/obj_dat.c

[Benjamin Kaduk]

On 01/23/2018 07:19 PM, Salz, Rich via openssl-dev wrote:
>
>   * OpenSSL APIs, which makes the following OpenSSL documentation
>     statement invalid
>     (https://www.openssl.org/docs/man1.0.2/crypto/threads.html
>     <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.openssl.org_docs_man1.0.2_crypto_threads.html&d=DwMFAw&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=ZS_kRxGa4vj0O6wqfY-6q7kwVT0WiIMkFqw1XWHym4o&s=GK3QtuXP-8j_1nbRihxeJGLAIYXt1BNIyh3WHP6EJlY&e=>)
>
>  
>
>   * "OpenSSL can safely be used in multi-threaded applications
>     provided that at least two callback functions are set,
>     locking_function and threadid_func."
>
>  
>
>   * Is there any planning to fix this issue?
>
>  
>
>  
>
> Well, the most likely fix is to make the “safely” wording be more
> vague, which I doubt you’ll like.  But I doubt anyone on the team has
> much interest in fixing 1.0.2 locking issues.
>
>

Who said they were 1.0.2-specific?  Master's obj_dat.c still has a
completely unlocked OBJ_new_nid() that is a public API function; AFAICT
the issue is still present.

-Ben
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-dev/attachments/20180124/c3693c19/attachment.html>