PikaOS ProjectsPika · #70
libcurl segfaults when using HTTP/3 with OpenSSL 4 / ngtcp2
After a huge package upgrade, curl always start to segfault when using http/3
Normal HTTPS requests work as expected. The crash affects PHP's cURL extension and causes its package manager to break / segfault when running most commands like composer install for example, which is why it caught my attention
I tried to track down the issue and it seems like its a combination of libcurl, ngtcp2 and openSSL packages
Some further Information I gather on my research: libcurl4t64 is built against openssl 4:
- libcurl4t64: 8.22.0~rc2-1+b1
- libssl4: 4.0.1-1
However the http3 openssl backend is linked against openssl 3:
- libngtcp2-16: 1.24.0-1
- libngtcp2-crypto-ossl0: 1.24.0-1
- libssl3t64: 3.6.3-1
objdump shows:
libcurl.so.4:
- libngtcp2_crypto_ossl.so.0
- libngtcp2.so.16
- libssl.so.4
- libcrypto.so.4
libngtcp2_crypto_ossl.so.0:
- libngtcp2.so.16
- libssl.so.3
- libcrypto.so.3
Bug report
Steps to reproduce
http version 3 in a curl request to pretty much any webpage:
curl --http3 https://getcomposer.org
This can also be reproduced via PHP if neccessary:
php -r '$ch = curl_init("https://getcomposer.org"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_3); var_dump(curl_exec($ch));'
Expected behavior
Receiving the html source of the page you run the request on. Reproducable with:
Actual behavior
Segmentation fault curl --http3 https://getcomposer.org -o /dev/null
with exit code 139
Output from gdb: Starting program: /usr/bin/curl --http3 https://getcomposer.org
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff63a46c0 (LWP 63766)]
[New Thread 0x7ffff5ba36c0 (LWP 63767)]
Thread 1 "curl" received signal SIGSEGV, Segmentation fault.
0x00007ffff7116e52 in SSL_set0_rbio () from /usr/lib/x86_64-linux-gnu/libssl.so.3
Environment
Pika 4 nest
Kernel 7.1.8-pikaos
on amd64
- curl: 8.22.0~rc2-1+b1
- libcurl4t64: 8.22.0~rc2-1+b1
- libngtcp2-16: 1.24.0-1
- libngtcp2-crypto-ossl0: 1.24.0-1
- libnghttp3-9: 1.17.0-1
- libssl3t64: 3.6.3-1
- libssl4: 4.0.1-1
- php8.4-curl: 8.4.24-1
- PHP: 8.4.24
Discussion
Sign in with Discord to comment.