Skip to content

Commit 11afd86

Browse files
authored
Defer RemoteCertificate assignment after X509 Chain build (#114781)
* Defer RemoteCertificate assignment after X509 Chain build * Add comment
1 parent 9a0b450 commit 11afd86

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1056,8 +1056,9 @@ internal bool VerifyRemoteCertificate(RemoteCertificateValidationCallback? remot
10561056
return true;
10571057
}
10581058

1059-
_remoteCertificate = certificate;
1060-
if (_remoteCertificate == null)
1059+
// don't assign to _remoteCertificate yet, this prevents weird exceptions if SslStream is disposed in parallel with X509Chain building
1060+
1061+
if (certificate == null)
10611062
{
10621063
if (NetEventSource.Log.IsEnabled() && RemoteCertRequired) NetEventSource.Error(this, $"Remote certificate required, but no remote certificate received");
10631064
sslPolicyErrors |= SslPolicyErrors.RemoteCertificateNotAvailable;
@@ -1099,15 +1100,17 @@ internal bool VerifyRemoteCertificate(RemoteCertificateValidationCallback? remot
10991100
sslPolicyErrors |= CertificateValidationPal.VerifyCertificateProperties(
11001101
_securityContext!,
11011102
chain,
1102-
_remoteCertificate,
1103+
certificate,
11031104
_sslAuthenticationOptions.CheckCertName,
11041105
_sslAuthenticationOptions.IsServer,
11051106
TargetHostNameHelper.NormalizeHostName(_sslAuthenticationOptions.TargetHost));
11061107
}
11071108

1109+
_remoteCertificate = certificate;
1110+
11081111
if (remoteCertValidationCallback != null)
11091112
{
1110-
success = remoteCertValidationCallback(this, _remoteCertificate, chain, sslPolicyErrors);
1113+
success = remoteCertValidationCallback(this, certificate, chain, sslPolicyErrors);
11111114
}
11121115
else
11131116
{

0 commit comments

Comments
 (0)