zeroc-ice 3.8.1 → 3.8.3

data/dist/ice/cpp/src/Ice/SSL/SchannelEngine.cpp

@@ -459,21 +459,28 @@ namespace
                                 throw InitializationException(
                                     __FILE__,
                                     __LINE__,
-                                    "SSL transport: invalid value '" + value + "' for `IceSSL.FindCert' property:\n" +
+                                    "SSL transport: invalid value '" + value + "' for 'IceSSL.FindCert' property:\n" +
                                         IceInternal::lastErrorToString());
                             }
 
                             vector<BYTE> buffer(length);
-                            if (!CertStrToNameW(X509_ASN_ENCODING, argW.c_str(), flags[i], 0, &buffer[0], &length, 0))
+                            if (!CertStrToNameW(
+                                    X509_ASN_ENCODING,
+                                    argW.c_str(),
+                                    flags[i],
+                                    0,
+                                    buffer.data(),
+                                    &length,
+                                    0))
                             {
                                 throw InitializationException(
                                     __FILE__,
                                     __LINE__,
-                                    "SSL transport: invalid value '" + value + "' for `IceSSL.FindCert' property:\n" +
+                                    "SSL transport: invalid value '" + value + "' for 'IceSSL.FindCert' property:\n" +
                                         IceInternal::lastErrorToString());
                             }
 
-                            CERT_NAME_BLOB name = {length, &buffer[0]};
+                            CERT_NAME_BLOB name = {length, buffer.data()};
 
                             DWORD findType = field == "SUBJECTDN" ? CERT_FIND_SUBJECT_NAME : CERT_FIND_ISSUER_NAME;
                             addMatchingCertificates(store, tmpStore, findType, &name);
@@ -487,10 +494,10 @@ namespace
                             throw InitializationException(
                                 __FILE__,
                                 __LINE__,
-                                "SSL transport: invalid 'IceSSL.FindCert' property: can't decode the value");
+                                "SSL transport: invalid 'IceSSL.FindCert' property: cannot decode the value");
                         }
 
-                        CRYPT_HASH_BLOB hash = {static_cast<DWORD>(buffer.size()), &buffer[0]};
+                        CRYPT_HASH_BLOB hash = {static_cast<DWORD>(buffer.size()), buffer.data()};
                         DWORD findType = field == "THUMBPRINT" ? CERT_FIND_HASH : CERT_FIND_KEY_IDENTIFIER;
                         addMatchingCertificates(store, tmpStore, findType, &hash);
                     }
@@ -502,7 +509,7 @@ namespace
                             throw InitializationException(
                                 __FILE__,
                                 __LINE__,
-                                "SSL transport: invalid value '" + value + "' for `IceSSL.FindCert' property");
+                                "SSL transport: invalid value '" + value + "' for 'IceSSL.FindCert' property");
                         }
 
                         // CRYPT_INTEGER_BLOB stores serial data in little-endian format, parseBytes returns big-endian
@@ -510,7 +517,7 @@ namespace
                         std::vector<BYTE> serialData(buffer.size());
                         std::reverse_copy(std::begin(buffer), std::end(buffer), std::begin(serialData));
 
-                        CRYPT_INTEGER_BLOB serial = {static_cast<DWORD>(serialData.size()), &serialData[0]};
+                        CRYPT_INTEGER_BLOB serial = {static_cast<DWORD>(serialData.size()), serialData.data()};
                         PCCERT_CONTEXT next = nullptr;
                         do
                         {
@@ -568,9 +575,12 @@ namespace
                          0,
                          CERT_FIND_ANY,
                          0,
-                         next)) != 0)
+                         next)) != nullptr)
                 {
-                    certs.push_back(next);
+                    // CertFindCertificateInStore frees the context passed as pPrevCertContext on the next iteration
+                    // (and frees the last one when it returns null). Duplicate the context to keep an owned reference
+                    // that remains valid after enumeration; these duplicates are released in the destructor.
+                    certs.push_back(CertDuplicateCertificateContext(next));
                 }
             } while (next);
             stores.push_back(store);
@@ -598,7 +608,13 @@ namespace
             if (startpos != string::npos)
             {
                 endpos = strbuf.find("-----END CERTIFICATE-----", startpos);
-                size = endpos - startpos + sizeof("-----END CERTIFICATE-----");
+                if (endpos == string::npos)
+                {
+                    ostringstream os;
+                    os << "SSL transport: malformed PEM certificate (missing END marker): '" << file << "'";
+                    throw InitializationException(__FILE__, __LINE__, os.str());
+                }
+                size = endpos - startpos + strlen("-----END CERTIFICATE-----");
             }
             else if (first)
             {
@@ -618,7 +634,7 @@ namespace
                     &buffer[startpos],
                     static_cast<DWORD>(size),
                     CRYPT_STRING_ANY,
-                    &outBuffer[0],
+                    outBuffer.data(),
                     &outLength,
                     0,
                     0))
@@ -633,7 +649,7 @@ namespace
             if (!CertAddEncodedCertificateToStore(
                     store,
                     X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
-                    &outBuffer[0],
+                    outBuffer.data(),
                     outLength,
                     CERT_STORE_ADD_NEW,
                     first ? cert : 0))
@@ -688,7 +704,7 @@ namespace
         }
         else
         {
-            // If subjectAlt is empty compare it to the subject CN, otherwise compare it to the to the subject alt
+            // If subjectAlt is empty compare it to the subject CN, otherwise compare it to the subject alt
             // name dnsNames.
             if (dnsNames.empty())
             {
@@ -734,6 +750,34 @@ namespace
             throw SecurityException(__FILE__, __LINE__, msg);
         }
     }
+
+    // Deletes the key container referenced by the certificate's CERT_KEY_PROV_INFO property, if it has one.
+    // With CRYPT_DELETEKEYSET, CryptAcquireContextW deletes the key container; the returned handle is undefined
+    // and must not be released. Machine key containers live in a separate store, so CRYPT_MACHINE_KEYSET must be
+    // carried over from the provider info or the container is not found.
+    void deleteKeyContainer(PCCERT_CONTEXT cert)
+    {
+        DWORD length = 0;
+        if (!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, nullptr, &length))
+        {
+            return;
+        }
+
+        vector<char> buf(length);
+        if (!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, buf.data(), &length))
+        {
+            return;
+        }
+
+        const CRYPT_KEY_PROV_INFO* keyProvInfo = reinterpret_cast<const CRYPT_KEY_PROV_INFO*>(buf.data());
+        HCRYPTPROV prov = 0;
+        CryptAcquireContextW(
+            &prov,
+            keyProvInfo->pwszContainerName,
+            keyProvInfo->pwszProvName,
+            keyProvInfo->dwProvType,
+            (keyProvInfo->dwFlags & CRYPT_MACHINE_KEYSET) | CRYPT_DELETEKEYSET);
+    }
 }
 
 Schannel::SSLEngine::SSLEngine(const IceInternal::InstancePtr& instance)
@@ -743,14 +787,57 @@ Schannel::SSLEngine::SSLEngine(const IceInternal::InstancePtr& instance)
 {
 }
 
+Schannel::SSLEngine::~SSLEngine()
+{
+    // Best-effort cleanup. We catch every exception (e.g. std::bad_alloc from the per-cert vector
+    // allocation below) so nothing escapes the destructor and triggers std::terminate.
+    try
+    {
+        if (_chainEngine && _chainEngine != HCCE_CURRENT_USER && _chainEngine != HCCE_LOCAL_MACHINE)
+        {
+            CertFreeCertificateChainEngine(_chainEngine);
+        }
+
+        if (_rootStore)
+        {
+            CertCloseStore(_rootStore, 0);
+        }
+
+        // Remove the key containers created for the certificates Ice imported. Certificates found in a system store
+        // are not listed in _importedCerts: their key containers belong to the user or the machine and must be kept.
+        for (vector<PCCERT_CONTEXT>::const_iterator i = _importedCerts.begin(); i != _importedCerts.end(); ++i)
+        {
+            deleteKeyContainer(*i);
+        }
+
+        for (vector<PCCERT_CONTEXT>::const_iterator i = _allCerts.begin(); i != _allCerts.end(); ++i)
+        {
+            CertFreeCertificateContext(*i);
+        }
+
+        for (vector<HCERTSTORE>::const_iterator i = _stores.begin(); i != _stores.end(); ++i)
+        {
+#ifdef NDEBUG
+            CertCloseStore(*i, 0);
+#else
+            // In debug builds, close the store with CERT_CLOSE_STORE_CHECK_FLAG to assert that every certificate
+            // context obtained from it was freed. The call returns false (last error CRYPT_E_PENDING_CLOSE) if any
+            // context is still outstanding, which catches certificate-reference leaks early.
+            const BOOL allContextsFreed = CertCloseStore(*i, CERT_CLOSE_STORE_CHECK_FLAG);
+            assert(allContextsFreed && "SSL transport: certificate context leaked (store closed with live contexts)");
+#endif
+        }
+    }
+    catch (...)
+    {
+    }
+}
+
 void
 Schannel::SSLEngine::initialize()
 {
-    //
-    // BUGFIX: we use a global mutex for the initialization of Schannel to
-    // avoid crashes occurring with last Schannel updates see:
-    // https://github.com/zeroc-ice/ice/issues/242
-    //
+    // We use a global mutex for the initialization of Schannel to avoid crashes observed with some Schannel
+    // updates.
     lock_guard globalLock(globalMutex);
 
     Ice::SSL::SSLEngine::initialize();
@@ -856,7 +943,7 @@ Schannel::SSLEngine::initialize()
 
         CRYPT_DATA_BLOB pfxBlob;
         pfxBlob.cbData = static_cast<DWORD>(buffer.size());
-        pfxBlob.pbData = reinterpret_cast<BYTE*>(&buffer[0]);
+        pfxBlob.pbData = reinterpret_cast<BYTE*>(buffer.data());
 
         PCCERT_CONTEXT cert = nullptr;
         DWORD importFlags = (certStoreLocation == "LocalMachine") ? CRYPT_MACHINE_KEYSET : CRYPT_USER_KEYSET;
@@ -902,10 +989,10 @@ Schannel::SSLEngine::initialize()
             }
             if (!cert)
             {
-                throw InitializationException(
-                    __FILE__,
-                    __LINE__,
-                    "SSL transport: certificate error:\n" + lastErrorToString());
+                // Read the error before closing the store, otherwise it reports the close instead of the lookup.
+                const string error = lastErrorToString();
+                CertCloseStore(store, 0);
+                throw InitializationException(__FILE__, __LINE__, "SSL transport: certificate error:\n" + error);
             }
             _allCerts.push_back(cert);
             _stores.push_back(store);
@@ -946,10 +1033,10 @@ Schannel::SSLEngine::initialize()
 
             // Convert the PEM encoded buffer to DER binary format.
             if (!CryptStringToBinary(
-                    &buffer[0],
+                    buffer.data(),
                     static_cast<DWORD>(buffer.size()),
                     CRYPT_STRING_BASE64HEADER,
-                    &outBuffer[0],
+                    outBuffer.data(),
                     &outLength,
                     0,
                     0))
@@ -962,6 +1049,10 @@ Schannel::SSLEngine::initialize()
             PCRYPT_PRIVATE_KEY_INFO keyInfo = nullptr;
             BYTE* key = nullptr;
             HCRYPTKEY hKey = 0;
+            HCRYPTPROV cryptProv = 0;
+            wstring keySetName;
+            DWORD contextFlags = 0;
+            bool keySetCreated = false;
             try
             {
                 // First try to decode as a PKCS#8 key, if that fails try PKCS#1.
@@ -969,7 +1060,7 @@ Schannel::SSLEngine::initialize()
                 if (CryptDecodeObjectEx(
                         X509_ASN_ENCODING,
                         PKCS_PRIVATE_KEY_INFO,
-                        &outBuffer[0],
+                        outBuffer.data(),
                         outLength,
                         CRYPT_DECODE_ALLOC_FLAG,
                         0,
@@ -1008,7 +1099,7 @@ Schannel::SSLEngine::initialize()
                     if (!CryptDecodeObjectEx(
                             X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                             PKCS_RSA_PRIVATE_KEY,
-                            &outBuffer[0],
+                            outBuffer.data(),
                             outLength,
                             CRYPT_DECODE_ALLOC_FLAG,
                             0,
@@ -1022,10 +1113,9 @@ Schannel::SSLEngine::initialize()
                 }
 
                 // Create a new RSA key set to store our key.
-                const wstring keySetName = Ice::stringToWstring(generateUUID());
-                HCRYPTPROV cryptProv = 0;
+                keySetName = Ice::stringToWstring(generateUUID());
 
-                DWORD contextFlags = CRYPT_NEWKEYSET;
+                contextFlags = CRYPT_NEWKEYSET;
                 if (certStoreLocation == "LocalMachine")
                 {
                     contextFlags |= CRYPT_MACHINE_KEYSET;
@@ -1043,6 +1133,7 @@ Schannel::SSLEngine::initialize()
                         __LINE__,
                         "SSL transport: error acquiring cryptographic context:\n" + lastErrorToString());
                 }
+                keySetCreated = true;
 
                 // Import the private key.
                 if (!CryptImportKey(cryptProv, key, outLength, 0, 0, &hKey))
@@ -1056,6 +1147,8 @@ Schannel::SSLEngine::initialize()
 
                 CryptDestroyKey(hKey);
                 hKey = 0;
+                CryptReleaseContext(cryptProv, 0);
+                cryptProv = 0;
 
                 // Create a new memory store to place the certificate.
                 store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0);
@@ -1073,8 +1166,11 @@ Schannel::SSLEngine::initialize()
                 CRYPT_KEY_PROV_INFO keyProvInfo;
                 memset(&keyProvInfo, 0, sizeof(keyProvInfo));
                 keyProvInfo.pwszContainerName = const_cast<wchar_t*>(keySetName.c_str());
-                keyProvInfo.pwszProvName = const_cast<wchar_t*>(MS_DEF_PROV_W);
+                // The provider name and flags must match the ones the container was created with above, otherwise
+                // neither the private key nor the container can be found again.
+                keyProvInfo.pwszProvName = const_cast<wchar_t*>(MS_ENHANCED_PROV_W);
                 keyProvInfo.dwProvType = PROV_RSA_FULL;
+                keyProvInfo.dwFlags = contextFlags & CRYPT_MACHINE_KEYSET;
                 keyProvInfo.dwKeySpec = AT_KEYEXCHANGE;
                 if (!CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &keyProvInfo))
                 {
@@ -1105,6 +1201,24 @@ Schannel::SSLEngine::initialize()
                     CryptDestroyKey(hKey);
                 }
 
+                if (cryptProv)
+                {
+                    CryptReleaseContext(cryptProv, 0);
+                }
+
+                if (keySetCreated)
+                {
+                    // With CRYPT_DELETEKEYSET, CryptAcquireContextW deletes the key container; the returned
+                    // handle is undefined and must not be released.
+                    HCRYPTPROV prov = 0;
+                    CryptAcquireContextW(
+                        &prov,
+                        keySetName.c_str(),
+                        MS_ENHANCED_PROV_W,
+                        PROV_RSA_FULL,
+                        (contextFlags & CRYPT_MACHINE_KEYSET) | CRYPT_DELETEKEYSET);
+                }
+
                 if (cert)
                 {
                     CertFreeCertificateContext(cert);
@@ -1210,49 +1324,6 @@ Schannel::SSLEngine::getCipherName(ALG_ID cipher) const
     }
 }
 
-void
-Schannel::SSLEngine::destroy()
-{
-    if (_chainEngine && _chainEngine != HCCE_CURRENT_USER && _chainEngine != HCCE_LOCAL_MACHINE)
-    {
-        CertFreeCertificateChainEngine(_chainEngine);
-    }
-
-    if (_rootStore)
-    {
-        CertCloseStore(_rootStore, 0);
-    }
-
-    for (vector<PCCERT_CONTEXT>::const_iterator i = _importedCerts.begin(); i != _importedCerts.end(); ++i)
-    {
-        // Retrieve the certificate CERT_KEY_PROV_INFO_PROP_ID property, we use the CRYPT_KEY_PROV_INFO data to remove
-        // the key set associated with the certificate.
-        DWORD length = 0;
-        if (!CertGetCertificateContextProperty(*i, CERT_KEY_PROV_INFO_PROP_ID, 0, &length))
-        {
-            continue;
-        }
-        vector<char> buf(length);
-        if (!CertGetCertificateContextProperty(*i, CERT_KEY_PROV_INFO_PROP_ID, &buf[0], &length))
-        {
-            continue;
-        }
-        CRYPT_KEY_PROV_INFO* key = reinterpret_cast<CRYPT_KEY_PROV_INFO*>(&buf[0]);
-        HCRYPTPROV prov = 0;
-        CryptAcquireContextW(&prov, key->pwszContainerName, key->pwszProvName, key->dwProvType, CRYPT_DELETEKEYSET);
-    }
-
-    for (vector<PCCERT_CONTEXT>::const_iterator i = _allCerts.begin(); i != _allCerts.end(); ++i)
-    {
-        CertFreeCertificateContext(*i);
-    }
-
-    for (vector<HCERTSTORE>::const_iterator i = _stores.begin(); i != _stores.end(); ++i)
-    {
-        CertCloseStore(*i, 0);
-    }
-}
-
 Ice::SSL::ClientAuthenticationOptions
 Schannel::SSLEngine::createClientAuthenticationOptions(const string& host) const
 {
@@ -1260,15 +1331,22 @@ Schannel::SSLEngine::createClientAuthenticationOptions(const string& host) const
         .clientCredentialsSelectionCallback =
             [this](const string&)
         {
+            // The transport takes ownership of the returned paCred contexts and releases them when the connection
+            // is closed (see ClientAuthenticationOptions). Bump the reference count of each certificate so the
+            // reference handed to the transport is independent of the engine's _allCerts, which outlives the
+            // individual connections.
             for (const auto& cert : _allCerts)
             {
-                CertDuplicateCertificateContext(cert);
+                // CertDuplicateCertificateContext returns the same pointer with an incremented reference count and
+                // cannot fail for a non-null context; the assert guards that invariant.
+                [[maybe_unused]] PCCERT_CONTEXT duplicate = CertDuplicateCertificateContext(cert);
+                assert(duplicate == cert);
             }
 
             return SCH_CREDENTIALS{
                 .dwVersion = SCH_CREDENTIALS_VERSION,
                 .cCreds = static_cast<DWORD>(_allCerts.size()),
-                .paCred = const_cast<PCCERT_CONTEXT*>(_allCerts.size() > 0 ? &_allCerts[0] : nullptr),
+                .paCred = const_cast<PCCERT_CONTEXT*>(_allCerts.data()),
                 .dwFlags = SCH_CRED_NO_DEFAULT_CREDS | SCH_CRED_NO_SERVERNAME_CHECK | SCH_USE_STRONG_CRYPTO};
         },
         .trustedRootCertificates = _rootStore,
@@ -1305,17 +1383,24 @@ Schannel::SSLEngine::createServerAuthenticationOptions() const
             [this](const string&)
         {
             {
+                // The transport takes ownership of the returned paCred contexts and releases them when the
+                // connection is closed (see ServerAuthenticationOptions). Bump the reference count of each
+                // certificate so the reference handed to the transport is independent of the engine's _allCerts,
+                // which outlives the individual connections.
                 for (const auto& cert : _allCerts)
                 {
-                    CertDuplicateCertificateContext(cert);
+                    // CertDuplicateCertificateContext returns the same pointer with an incremented reference count
+                    // and cannot fail for a non-null context; the assert guards that invariant.
+                    [[maybe_unused]] PCCERT_CONTEXT duplicate = CertDuplicateCertificateContext(cert);
+                    assert(duplicate == cert);
                 }
 
                 return SCH_CREDENTIALS{
                     .dwVersion = SCH_CREDENTIALS_VERSION,
                     .cCreds = static_cast<DWORD>(_allCerts.size()),
-                    .paCred = const_cast<PCCERT_CONTEXT*>(_allCerts.size() > 0 ? &_allCerts[0] : nullptr),
+                    .paCred = const_cast<PCCERT_CONTEXT*>(_allCerts.data()),
                     // Don't set SCH_SEND_ROOT_CERT as it seems to cause problems with Java certificate validation and
-                    // Schannel doesn't seems to send the root certificate either way.
+                    // Schannel doesn't seem to send the root certificate either way.
                     .dwFlags = SCH_CRED_NO_SYSTEM_MAPPER | SCH_USE_STRONG_CRYPTO};
             }
         },

data/dist/ice/cpp/src/Ice/SSL/SchannelEngine.h

@@ -22,17 +22,13 @@ namespace Ice::SSL::Schannel
     {
     public:
         SSLEngine(const IceInternal::InstancePtr&);
+        ~SSLEngine() override;
 
         //
         // Setup the engine.
         //
         void initialize() final;
 
-        //
-        // Destroy the engine.
-        //
-        void destroy() final;
-
         [[nodiscard]] std::string getCipherName(ALG_ID) const;
 
         [[nodiscard]] Ice::SSL::ClientAuthenticationOptions

data/dist/ice/cpp/src/Ice/SSL/SchannelTransceiverI.cpp

@@ -93,7 +93,7 @@ namespace
         return SCH_CREDENTIALS{
             .dwVersion = SCH_CREDENTIALS_VERSION,
             // Don't set SCH_SEND_ROOT_CERT as it seems to cause problems with Java certificate validation and
-            // Schannel doesn't seems to send the root certificate either way.
+            // Schannel doesn't seem to send the root certificate either way.
             .dwFlags = SCH_CRED_NO_SYSTEM_MAPPER | SCH_USE_STRONG_CRYPTO};
     }
 }
@@ -136,18 +136,31 @@ Schannel::TransceiverI::sslHandshake(SecBuffer* initialBuffer)
 
         if (_credentials.cCreds > 0)
         {
-            for (DWORD i = 0; i < _credentials.cCreds; ++i)
+            if (!_credentials.paCred)
             {
-                if (!_credentials.paCred[i])
+                throw SecurityException(
+                    __FILE__,
+                    __LINE__,
+                    "SSL transport: the provided SCH_CREDENTIALS sets cCreds but paCred is null.");
+            }
+
+            // The credentials callback transfers ownership of the paCred contexts to the transport (see
+            // ClientAuthenticationOptions / ServerAuthenticationOptions). Record ownership of every context
+            // before validating below, so close() releases the full transferred set even if validation throws
+            // (CertFreeCertificateContext(nullptr) is a no-op). They are released in close().
+            _allCerts.assign(_credentials.paCred, _credentials.paCred + _credentials.cCreds);
+            _credentials.paCred = _allCerts.data();
+
+            for (PCCERT_CONTEXT certificate : _allCerts)
+            {
+                if (!certificate)
                 {
                     throw SecurityException(
                         __FILE__,
                         __LINE__,
                         "SSL transport: invalid null certificate in the provided SCH_CREDENTIALS.");
                 }
-                _allCerts.push_back(CertDuplicateCertificateContext(_credentials.paCred[i]));
             }
-            _credentials.paCred = &_allCerts[0];
         }
 
         err = AcquireCredentialsHandle(
@@ -197,6 +210,10 @@ Schannel::TransceiverI::sslHandshake(SecBuffer* initialBuffer)
                 0);
             if (err != SEC_E_OK && err != SEC_I_CONTINUE_NEEDED)
             {
+                if (outBuffer.pvBuffer)
+                {
+                    FreeContextBuffer(outBuffer.pvBuffer);
+                }
                 ostringstream os;
                 os << "SSL transport: handshake failure:\n" << IceInternal::errorToString(err);
                 throw SecurityException(__FILE__, __LINE__, os.str());
@@ -295,6 +312,15 @@ Schannel::TransceiverI::sslHandshake(SecBuffer* initialBuffer)
             }
             else if (err != SEC_I_CONTINUE_NEEDED && err != SEC_E_OK)
             {
+                if (outBuffers[0].pvBuffer) // token
+                {
+                    FreeContextBuffer(outBuffers[0].pvBuffer);
+                }
+                if (outBuffers[1].pvBuffer) // alert
+                {
+                    FreeContextBuffer(outBuffers[1].pvBuffer);
+                }
+
                 ostringstream os;
                 os << "SSL handshake failure:\n" << IceInternal::errorToString(err);
                 throw SecurityException(__FILE__, __LINE__, os.str());
@@ -552,6 +578,15 @@ Schannel::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
         }
         else if (err == SEC_I_RENEGOTIATE)
         {
+            if (_incoming)
+            {
+                // Reject peer-initiated TLS renegotiation on the server side: it is a CPU-asymmetric
+                // denial-of-service primitive on TLS 1.2 and is removed entirely in TLS 1.3.
+                throw ProtocolException(
+                    __FILE__,
+                    __LINE__,
+                    "SSL transport: peer-initiated TLS renegotiation is not supported on the server side.");
+            }
             if (_sslConnectionRenegotiating)
             {
                 throw ProtocolException(
@@ -570,7 +605,15 @@ Schannel::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
                 memcpy(_extraBuffer.i, extraBuffer->pvBuffer, extraBuffer->cbBuffer);
                 _extraBuffer.i += extraBuffer->cbBuffer;
             }
-            return 0;
+            // Unlike the SEC_E_OK path below, we deliberately leave _readBuffer untouched here: sslHandshake resumes
+            // the handshake from the data still buffered in _readBuffer and moves the trailing post-renegotiation
+            // records back to its front, which is how the application data following the renegotiation is recovered.
+            // Resetting _readBuffer.i here would underflow that memmove.
+            // Return the application data already copied into the caller's buffer during this call (it may be non-zero
+            // because earlier records in the same batch were decrypted before this renegotiation request). The caller
+            // must advance buf.i by this amount before performing the re-handshake, otherwise the next decryptMessage
+            // overwrites these bytes and the plaintext is silently lost.
+            return i - buffer.i;
         }
         else if (err == SEC_I_CONTEXT_EXPIRED)
         {
@@ -794,6 +837,9 @@ Schannel::TransceiverI::read(IceInternal::Buffer& buf)
         }
 
         size_t decrypted = decryptMessage(buf);
+        // Account for the bytes decryptMessage copied into buf right away, so a renegotiation in the middle of the
+        // batch does not drop the plaintext already extracted before it.
+        buf.i += decrypted;
         if (_sslConnectionRenegotiating)
         {
             // The peer has requested a renegotiation.
@@ -819,8 +865,6 @@ Schannel::TransceiverI::read(IceInternal::Buffer& buf)
             }
             continue;
         }
-
-        buf.i += decrypted;
     }
     _delegate->getNativeInfo()->ready(
         IceInternal::SocketOperationRead,
@@ -890,10 +934,14 @@ Schannel::TransceiverI::finishRead(IceInternal::Buffer& buf)
     _delegate->finishRead(_readBuffer);
     if (_state == StateHandshakeComplete)
     {
-        size_t decrypted;
-        while (true)
+        std::byte* const start = buf.i;
+        // Decrypt the buffered data into buf, advancing buf.i as we go so that a renegotiation in the middle of the
+        // batch does not drop or overwrite the plaintext already extracted. The loop guard matches decryptMessage's
+        // precondition: there is buffered (_readBuffer) or unprocessed data left to decrypt.
+        while (buf.i != buf.b.end() && (_readBuffer.i != _readBuffer.b.begin() || !_readUnprocessed.b.empty()))
         {
-            decrypted = decryptMessage(buf);
+            size_t decrypted = decryptMessage(buf);
+            buf.i += decrypted;
             if (_sslConnectionRenegotiating)
             {
                 // The peer has requested a renegotiation.
@@ -903,31 +951,23 @@ Schannel::TransceiverI::finishRead(IceInternal::Buffer& buf)
                     _extraBuffer.b.begin()};
                 IceInternal::SocketOperation op = sslHandshake(&extraBuffer);
                 _extraBuffer.b.clear();
-                if (op == IceInternal::SocketOperationNone)
+                if (op != IceInternal::SocketOperationNone)
                 {
-                    _sslConnectionRenegotiating = false;
-                    if (buf.i != buf.b.begin())
-                    {
-                        continue;
-                    }
-                    break;
+                    throw ConnectionLostException(__FILE__, __LINE__);
                 }
-                throw ConnectionLostException(__FILE__, __LINE__);
+                _sslConnectionRenegotiating = false;
+                continue;
+            }
+            if (decrypted == 0)
+            {
+                // Not enough buffered data to decrypt a complete record; wait for the next read.
+                break;
             }
-            break;
         }
 
-        if (decrypted > 0)
-        {
-            buf.i += decrypted;
-            _delegate->getNativeInfo()->ready(
-                IceInternal::SocketOperationRead,
-                !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin());
-        }
-        else
-        {
-            _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
-        }
+        _delegate->getNativeInfo()->ready(
+            IceInternal::SocketOperationRead,
+            buf.i != start && (!_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin()));
     }
 }
 
@@ -1065,8 +1105,8 @@ Schannel::TransceiverI::TransceiverI(
                 false);       // Whether or not revocation checks only uses cached information.
         };
     }
-    // If the user provides a validation callback is up to the callback to validate the certificate chain.
-    // If the user doesn't set the trusted root certificates, we use Schannel default behavior, with uses the system
+    // If the user provides a validation callback, it is up to the callback to validate the certificate chain.
+    // If the user doesn't set the trusted root certificates, we use Schannel default behavior, which uses the system
     // trusted root certificates.
 }
 

data/dist/ice/cpp/src/Ice/SSL/SchannelTransceiverI.h

@@ -95,7 +95,6 @@ namespace Ice::SSL::Schannel
         std::function<SCH_CREDENTIALS(const std::string&)> _localCredentialsSelectionCallback;
         std::function<void(CtxtHandle context, const std::string& host)> _sslNewSessionCallback;
         SecPkgContext_StreamSizes _sizes;
-        std::string _cipher;
         PCCERT_CONTEXT _peerCertificate;
         std::function<bool(CtxtHandle, const Ice::SSL::ConnectionInfoPtr&)> _remoteCertificateValidationCallback;
         bool _clientCertificateRequired;