From c492d43f4817eb65cd251749bd074df7bb4ebc28 Mon Sep 17 00:00:00 2001
From: Ben Noordhuis <info@bnoordhuis.nl>
Date: Mon, 13 Aug 2012 17:31:22 +0200
Subject: [PATCH] tls: fix segfault in pummel/test-tls-ci-reneg-attack

Commit 4e5fe2d changed the way how process.nextTick() works:

    process.nextTick(function foo() {
      process.nextTick(function bar() {
        // ...
      });
    });

Before said commit, foo() and bar() used to run on separate event loop ticks
but that is no longer the case.

However, that's exactly the behavior that the TLS renegotiation attack guard
relies on. It gets called by OpenSSL and needs to defer the 'error' event to a
later tick because the default action is to destroy the TLS context - the same
context that OpenSSL currently operates on.

When things change underneath your feet, bad things happen and OpenSSL is no
exception. Ergo, use setImmediate() instead of process.nextTick() to ensure
that the 'error' event is actually emitted at a later tick.

Fixes #3840.
---
 lib/tls.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tls.js b/lib/tls.js
index 55acac7ff2..0edd9d200f 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -702,7 +702,7 @@ function onhandshakestart() {
     // Defer the error event to the next tick. We're being called from OpenSSL's
     // state machine and OpenSSL is not re-entrant. We cannot allow the user's
     // callback to destroy the connection right now, it would crash and burn.
-    process.nextTick(function() {
+    setImmediate(function() {
       var err = new Error('TLS session renegotiation attack detected.');
       if (self.cleartext) self.cleartext.emit('error', err);
     });