Bug 2341677 - openSSL (and curl) freeze on RAND_status() when code crossed compile with x86_64-w64-mingw32-gcc
Summary: openSSL (and curl) freeze on RAND_status() when code crossed compile with x86...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: mingw-openssl
Version: 41
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Richard W.M. Jones
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-01-23 08:18 UTC by Pierre Blavy
Modified: 2025-03-20 00:15 UTC (History)
6 users (show)

Fixed In Version: mingw-openssl-3.2.4-2.fc43 mingw-openssl-3.2.4-2.fc42
Clone Of:
Environment:
Last Closed: 2025-03-05 13:18:00 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Pierre Blavy 2025-01-23 08:18:56 UTC
Code crossed compile with mingw64-openssl freezes on wine and windows 11 when calling RAND_status()





Reproducible: Always

Steps to Reproduce:
--- compile main.c ---
x86_64-w64-mingw32-gcc -o test.exe test.c -lssl -lcrypto
cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libcrypto-3-x64.dll ./
cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssl-3-x64.dll ./
cp /usr/x86_64-w64-mingw32/sys-root/mingw/bin/zlib1.dll ./

--- main .c ---
#include <stdio.h>
#include <openssl/rand.h>
#include <openssl/ssl.h>

int main(int argc, const char **argv)
{
  int flags = OPENSSL_INIT_ENGINE_ALL_BUILTIN | OPENSSL_INIT_LOAD_CONFIG;
  OPENSSL_init_ssl(flags, NULL);
  printf("OpenSSL_version: %s\n", OpenSSL_version(OPENSSL_VERSION));
  printf("RAND_status: %d\n", RAND_status());
  return 0;
}

--- run ---
./test.exe
Actual Results:  
--- output (wine) ---
./test.exe 
002c:fixme:winediag:loader_init wine-staging 10.0-rc4 is a testing version containing experimental patches.
002c:fixme:winediag:loader_init Please mention your exact version when filing bug reports on winehq.org.
OpenSSL_version: OpenSSL 3.2.2 4 Jun 2024
<<< FROZEN HERE >>>

--- output (windows 11) ---
PS C:\Users\a\Desktop\test> ./test.exe 
OpenSSL_version: OpenSSL 3.2.2 4 Jun 2024
<<< FROZEN HERE >>>

The bug is the same in wine and in windows.

Expected Results:  
test.exe should not freeze at RAND_status(), instead it should print something and finish.

RELATED BUG
This problems affects curl, the bug was originally reported here
https://github.com/curl/curl/issues/16070
There is a backtrace and tests with different version of libssl that may help.


VERSIONS
uname -a
Linux fedora 6.12.9-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jan  9 16:05:40 UTC 2025 x86_64 GNU/Linux

mingw64-openssl 
3.2.2-2.fc41

x86_64-w64-mingw32-gcc --version
x86_64-w64-mingw32-gcc (GCC) 14.2.1 20240801 (Fedora MinGW 14.2.1-3.fc41)
Copyright (C) 2024 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Comment 1 Pierre Blavy 2025-01-23 15:21:01 UTC
I've tried to compile the last openssl version (3.5.0-dev), and used it instead of the system one. 
With this version, the bug is fixed.



--- details ---
mkdir /var/tmp/test
cd /var/tmp/test

# compile libssl
HERE=`pwd`
git clone https://github.com/openssl/openssl.git
cd openssl

./Configure mingw64 --prefix="$HERE/openssl-windows"  --openssldir="$HERE/openssl-windows"  --cross-compile-prefix="x86_64-w64-mingw32-"
make -j16
make install


# compile test code.

cd "$HERE"
rm -f test.exe
x86_64-w64-mingw32-gcc -o test.exe test.c -Lopenssl-windows/lib64/ -lssl -lcrypto

cp openssl-windows/bin/libssl-3-x64.dll ./
cp openssl-windows/bin/libcrypto-3-x64.dll ./

./test.exe

--- output (ok) ---
./test.exe 
002c:fixme:winediag:loader_init wine-staging 10.0-rc4 is a testing version containing experimental patches.
002c:fixme:winediag:loader_init Please mention your exact version when filing bug reports on winehq.org.
OpenSSL_version: OpenSSL 3.5.0-dev
RAND_status: 1

Comment 2 sdelang 2025-01-23 16:23:41 UTC
I have encountered the same issue, also through the use of libcurl, while migrating a cross-compile build to fedora 41 (via docker) today, so I can't tell if this is a new regression.
Downgrading the build to up-to-date fedora 40 and using the .dll from there solved the issue, if this helps.

Comment 3 Pierre Blavy 2025-01-27 08:44:03 UTC
WORKAROUND 
option 1 : use fedora 40, see previous comment

option 2 : use open ssl 3.4.0. 

* For openssl : 
  run compile_openssl.sh

* For curl : 
  dnf install libtool  mingw64-libpsl
  run compile_openssl.sh and compile_curl.sh

* Then link and use the dll of the versions you've just build


--- compile_openssl.sh ---
#!/bin/sh
HERE=`pwd`

wget https://github.com/openssl/openssl/releases/download/openssl-3.4.0/openssl-3.4.0.tar.gz
tar -xf openssl-3.4.0.tar.gz
cd openssl-3.4.0

./Configure mingw64 --prefix="$HERE/openssl-windows"  --openssldir="$HERE/openssl-windows"  --cross-compile-prefix="x86_64-w64-mingw32-"
make -j16
make install



--- compile_curl.sh ---
#!/bin/sh
HERE=`pwd`

git clone https://github.com/curl/curl.git
cd "$HERE/curl"

autoreconf -fi
  # BUG : error: possibly undefined macro: AC_LIBTOOL_WIN32_DLL
  # FIX : sudo dnf -y install libtool

./configure --prefix="$HERE/curl-windows" --host="x86_64-w64-mingw32" --with-openssl="$HERE/openssl-windows" 
  # BUG : missing libpsl
  # FIX : dnf install mingw64-libpsl

make -j16
make install




PROPOSAL FOR FIXING THE BUG : 
- upgrade mingw64-openssl to 3.4.0
- compile mingw64-curl to use this ssl version. 
- push these packages to the fedora repository.

Comment 4 Richard W.M. Jones 2025-02-03 12:37:40 UTC
We're at parity with the latest Fedora openssl, ie. version 3.2.2, and we wouldn't
usually go ahead of that package.

Do you know what specific upstream commit fixes this?  It would be easier if we can
just backport that fix.

If not then we'll have to wait until the Fedora openssl package is upgraded.

Comment 5 Pierre Blavy 2025-02-13 13:51:07 UTC
No I don't I only know:

3.2.2 4 Jun 2024  Buggy
3.3.2 OK
3.4.0 OK

Comment 6 Richard W.M. Jones 2025-02-13 14:53:18 UTC
Fedora has updated the base openssl package to 3.2.4 [sic] yesterday.  Seems like
an odd version to choose since the newest is 3.4.1, but I'm not going to second-guess
that.  Do you know if 3.2.4 is affected?

Comment 7 Richard W.M. Jones 2025-03-05 12:42:19 UTC
See also analysis here which suggests a downstream patch is to blame:
https://bugzilla.redhat.com/show_bug.cgi?id=2349935

Comment 8 Fedora Update System 2025-03-05 13:13:22 UTC
FEDORA-2025-9a6a7e04ac (mingw-openssl-3.2.4-2.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-9a6a7e04ac

Comment 9 Fedora Update System 2025-03-05 13:18:00 UTC
FEDORA-2025-9a6a7e04ac (mingw-openssl-3.2.4-2.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Richard W.M. Jones 2025-03-05 13:28:43 UTC
Please test - if it is still happening with the latest package, reopen the bug.

Comment 11 Fedora Update System 2025-03-11 09:42:59 UTC
FEDORA-2025-7ec6fa845b (mingw-openssl-3.2.4-2.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b

Comment 12 Fedora Update System 2025-03-12 01:44:50 UTC
FEDORA-2025-7ec6fa845b has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-7ec6fa845b`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-7ec6fa845b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2025-03-20 00:15:56 UTC
FEDORA-2025-7ec6fa845b (mingw-openssl-3.2.4-2.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.