zeroc-ice 3.8.1 → 3.8.3

data/dist/ice/cpp/src/Ice/SSL/SecureTransportEngine.cpp

@@ -9,10 +9,17 @@
 #include "Ice/Logger.h"
 #include "Ice/Properties.h"
 #include "Ice/SSL/SSLException.h"
+#include "Ice/UUID.h"
 #include "SSLEngine.h"
 #include "SSLUtil.h"
 #include "SecureTransportUtil.h"
 
+#include <cerrno>
+#include <climits>
+#include <cstring>
+#include <unistd.h>
+#include <vector>
+
 // Disable deprecation warnings from SecureTransport APIs
 #include "../DisableWarnings.h"
 
@@ -27,8 +34,8 @@ namespace
     //
     // Retrieve the name of a cipher, SSLCipherSuite includes duplicated values for TLS/SSL
     // protocol ciphers, for example SSL_RSA_WITH_RC4_128_MD5/TLS_RSA_WITH_RC4_128_MD5
-    // are represented by the same SSLCipherSuite value, the names return by this method
-    // doesn't include a protocol prefix.
+    // are represented by the same SSLCipherSuite value: the names returned by this method
+    // don't include a protocol prefix.
     //
     string cipherName(SSLCipherSuite cipher)
     {
@@ -330,7 +337,7 @@ namespace
             case TLS_PSK_WITH_AES_256_CBC_SHA384:
                 return "PSK_WITH_AES_256_CBC_SHA384";
             case TLS_PSK_WITH_NULL_SHA256:
-                return "WITH_NULL_SHA256";
+                return "PSK_WITH_NULL_SHA256";
             case TLS_PSK_WITH_NULL_SHA384:
                 return "PSK_WITH_NULL_SHA384";
 
@@ -547,6 +554,43 @@ namespace
             }
         }
     }
+
+#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
+    // Creates a private temporary directory to hold a short-lived keychain, and returns its path.
+    // Uses confstr(_CS_DARWIN_USER_TEMP_DIR) rather than $TMPDIR so the location can't be
+    // redirected through the process environment.
+    string createTemporaryKeychainDirectory()
+    {
+        char base[PATH_MAX];
+        size_t len = confstr(_CS_DARWIN_USER_TEMP_DIR, base, sizeof(base));
+        if (len == 0 || len > sizeof(base))
+        {
+            int error = errno;
+
+            ostringstream os;
+            os << "SSL transport: confstr(_CS_DARWIN_USER_TEMP_DIR) failed";
+            if (error != 0)
+            {
+                os << ": " << strerror(error);
+            }
+            throw InitializationException(__FILE__, __LINE__, os.str());
+        }
+
+        string tmpl = string{base} + "ice-keychain-XXXXXX";
+        vector<char> buffer(tmpl.begin(), tmpl.end());
+        buffer.push_back('\0');
+
+        char* dir = mkdtemp(buffer.data());
+        if (dir == nullptr)
+        {
+            int error = errno;
+            ostringstream os;
+            os << "SSL transport: mkdtemp failed: " << strerror(error);
+            throw InitializationException(__FILE__, __LINE__, os.str());
+        }
+        return dir;
+    }
+#endif
 }
 
 SecureTransport::SSLEngine::SSLEngine(const IceInternal::InstancePtr& instance)
@@ -556,7 +600,25 @@ SecureTransport::SSLEngine::SSLEngine(const IceInternal::InstancePtr& instance)
 {
 }
 
-SecureTransport::SSLEngine::~SSLEngine() = default;
+SecureTransport::SSLEngine::~SSLEngine()
+{
+#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
+    if (!_temporaryKeychainDir.empty())
+    {
+        // Remove the temporary keychain and its enclosing directory created by initialize().
+        // The cleanup lives in the destructor (not destroy()) so it also runs when initialize()
+        // throws after the directory has been created.
+        _chain.reset();
+        const string keychainPath = _temporaryKeychainDir + "/ice.keychain";
+        UniqueRef<SecKeychainRef> keychain;
+        if (SecKeychainOpen(keychainPath.c_str(), &keychain.get()) == noErr && keychain.get())
+        {
+            SecKeychainDelete(keychain.get());
+        }
+        rmdir(_temporaryKeychainDir.c_str());
+    }
+#endif
+}
 
 //
 // Setup the engine.
@@ -636,6 +698,18 @@ SecureTransport::SSLEngine::initialize()
             keyFile = *resolved;
         }
 
+#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
+        if (keychain.empty())
+        {
+            // Import the certificate into a temporary keychain rather than the user's login keychain.
+            // A private key in the login keychain cannot complete a forward-secret (ECDHE) handshake
+            // on the server side. The keychain and its enclosing directory are removed by the destructor.
+            _temporaryKeychainDir = createTemporaryKeychainDirectory();
+            keychain = _temporaryKeychainDir + "/ice.keychain";
+            keychainPassword = Ice::generateUUID();
+        }
+#endif
+
         try
         {
             _chain.reset(loadCertificateChain(certFile, keyFile, keychain, keychainPassword, password));
@@ -651,14 +725,6 @@ SecureTransport::SSLEngine::initialize()
     }
 }
 
-//
-// Destroy the engine.
-//
-void
-SecureTransport::SSLEngine::destroy()
-{
-}
-
 ClientAuthenticationOptions
 SecureTransport::SSLEngine::createClientAuthenticationOptions(const string& host) const
 {
@@ -721,15 +787,15 @@ SecureTransport::SSLEngine::createServerAuthenticationOptions() const
 SSLContextRef
 SecureTransport::SSLEngine::newContext(bool incoming) const
 {
-    SSLContextRef ssl =
-        SSLCreateContext(kCFAllocatorDefault, incoming ? kSSLServerSide : kSSLClientSide, kSSLStreamType);
-    if (!ssl)
+    UniqueRef<SSLContextRef> ssl(
+        SSLCreateContext(kCFAllocatorDefault, incoming ? kSSLServerSide : kSSLClientSide, kSSLStreamType));
+    if (!ssl.get())
     {
         throw SecurityException(__FILE__, __LINE__, "SSL transport: unable to create SSL context");
     }
 
     OSStatus err = SSLSetSessionOption(
-        ssl,
+        ssl.get(),
         incoming ? kSSLSessionOptionBreakOnClientAuth : kSSLSessionOptionBreakOnServerAuth,
         true);
 
@@ -741,7 +807,34 @@ SecureTransport::SSLEngine::newContext(bool incoming) const
             "SSL transport: error while setting SSL option:\n" + sslErrorToString(err));
     }
 
-    return ssl;
+    // Require TLS 1.2 or later. SecureTransport otherwise negotiates down to TLS 1.0 on macOS.
+    err = SSLSetProtocolVersionMin(ssl.get(), kTLSProtocol12);
+    if (err != noErr)
+    {
+        throw SecurityException(
+            __FILE__,
+            __LINE__,
+            "SSL transport: error while setting the minimum protocol version:\n" + sslErrorToString(err));
+    }
+
+    // Enable only forward-secret cipher suites: the Mozilla "Intermediate" recommendation for TLS 1.2
+    // intersected with what SecureTransport can negotiate — ECDHE key exchange with AES-GCM.
+    // SecureTransport's own default set also includes static-RSA suites (no forward secrecy) and 3DES.
+    const SSLCipherSuite ciphers[] = {
+        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384};
+    err = SSLSetEnabledCiphers(ssl.get(), ciphers, sizeof(ciphers) / sizeof(SSLCipherSuite));
+    if (err != noErr)
+    {
+        throw SecurityException(
+            __FILE__,
+            __LINE__,
+            "SSL transport: error while setting ciphers:\n" + sslErrorToString(err));
+    }
+
+    return ssl.release();
 }
 
 bool

data/dist/ice/cpp/src/Ice/SSL/SecureTransportEngine.h

@@ -20,10 +20,9 @@ namespace Ice::SSL::SecureTransport
     {
     public:
         SSLEngine(const IceInternal::InstancePtr&);
-        ~SSLEngine();
+        ~SSLEngine() override;
 
         void initialize() final;
-        void destroy() final;
 
         [[nodiscard]] Ice::SSL::ClientAuthenticationOptions
         createClientAuthenticationOptions(const std::string& host) const final;
@@ -37,6 +36,12 @@ namespace Ice::SSL::SecureTransport
     private:
         IceInternal::UniqueRef<CFArrayRef> _certificateAuthorities;
         IceInternal::UniqueRef<CFArrayRef> _chain;
+
+#    if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
+        // Path of the temporary directory holding the imported certificate's keychain, removed by the destructor.
+        // Empty when IceSSL.Keychain is set or no certificate is configured.
+        std::string _temporaryKeychainDir;
+#    endif
     };
 }
 #endif

data/dist/ice/cpp/src/Ice/SSL/SecureTransportTransceiverI.cpp

@@ -229,7 +229,7 @@ Ice::SSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuf
                     continue; // Call SSLHandshake to resume the handshake.
                 }
             }
-            // Let it fall through, this will raise a SecurityException with the SSLCopyPeerTrust error.
+            // Let it fall through, this will throw a ProtocolException with the SSLCopyPeerTrust error.
         }
         else if (err == errSSLClosedGraceful || err == errSSLClosedAbort)
         {
@@ -245,6 +245,12 @@ Ice::SSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuf
 
     assert(_ssl);
 
+    if (!_peerCertificate)
+    {
+        _engine->verifyPeer(dynamic_pointer_cast<ConnectionInfo>(getInfo(_incoming, _adapterName, "")));
+    }
+    // else verifyPeer is called from the certificate validation callback.
+
     if (_instance->engine()->securityTraceLevel() >= 1)
     {
         Trace out(_instance->logger(), _engine->securityTraceCategory());
@@ -345,7 +351,7 @@ Ice::SSL::SecureTransport::TransceiverI::write(IceInternal::Buffer& buf)
             }
 
             //
-            // SSL protocol errors are defined in SecureTransport.h are in the range
+            // SSL protocol errors defined in SecureTransport.h are in the range
             // -9800 to -9849
             //
             if (err <= -9800 && err >= -9849)
@@ -418,7 +424,7 @@ Ice::SSL::SecureTransport::TransceiverI::read(IceInternal::Buffer& buf)
             }
 
             //
-            // SSL protocol errors are defined in SecureTransport.h are in the range
+            // SSL protocol errors defined in SecureTransport.h are in the range
             // -9800 to -9849
             //
             if (err <= -9800 && err >= -9849)

data/dist/ice/cpp/src/Ice/SSL/SecureTransportUtil.cpp

@@ -206,25 +206,6 @@ Ice::SSL::SecureTransport::sslErrorToString(OSStatus status)
 }
 
 #if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-CFDictionaryRef
-Ice::SSL::SecureTransport::getCertificateProperty(SecCertificateRef cert, CFTypeRef key)
-{
-    UniqueRef<CFDictionaryRef> property;
-    UniqueRef<CFArrayRef> keys(CFArrayCreate(nullptr, &key, 1, &kCFTypeArrayCallBacks));
-    UniqueRef<CFErrorRef> err;
-    UniqueRef<CFDictionaryRef> values(SecCertificateCopyValues(cert, keys.get(), &err.get()));
-    if (err)
-    {
-        ostringstream os;
-        os << "SSL transport: error getting property for certificate:\n" << sslErrorToString(err);
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-
-    assert(values);
-    property.retain(static_cast<CFDictionaryRef>(CFDictionaryGetValue(values.get(), key)));
-    return property.release();
-}
-
 namespace
 {
     //
@@ -264,12 +245,10 @@ namespace
         memset(&params, 0, sizeof(params));
         params.version = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION;
         params.flags |= kSecKeyNoAccessControl;
-        UniqueRef<CFStringRef> passphraseHolder;
-        if (!passphrase.empty())
-        {
-            passphraseHolder.reset(toCFString(passphrase));
-            params.passphrase = passphraseHolder.get();
-        }
+        // Always pass a passphrase, even an empty one: SecItemImport rejects a PKCS12 file with
+        // errSecPassphraseRequired when params.passphrase is null, without looking at the file contents.
+        UniqueRef<CFStringRef> passphraseHolder(toCFString(passphrase));
+        params.passphrase = passphraseHolder.get();
 
         UniqueRef<CFArrayRef> items;
         SecExternalItemType importType = type;
@@ -277,6 +256,26 @@ namespace
         UniqueRef<CFStringRef> path(toCFString(file));
         OSStatus err = SecItemImport(data.get(), path.get(), &format, &importType, 0, &params, keychain, &items.get());
 
+        if (err == errSecPkcs12VerifyFailure && passphrase.empty())
+        {
+            // There are two encodings of the empty PKCS12 password, and they derive different keys. RFC 7292
+            // appendix B.1 formats every password as a NULL-terminated UTF-16BE string, which makes the empty
+            // password two 0x00 bytes; appendix B.2 step 3 instead notes that an empty password gives an empty
+            // block. openssl and keytool write the first, .NET writes either one depending on whether the
+            // password is "" or null.
+            //
+            // SecItemImport reads a CFString passphrase as the second encoding and a CFData passphrase as the
+            // raw password bytes, so retry with the two bytes appendix B.1 asks for. This mirrors .NET's own
+            // PKCS12 reader, which retries the other encoding when MAC verification fails.
+            const uint8_t emptyPassword[2] = {0, 0};
+            UniqueRef<CFDataRef> dataPassphrase(
+                CFDataCreate(kCFAllocatorDefault, emptyPassword, sizeof(emptyPassword)));
+            params.passphrase = dataPassphrase.get();
+            importType = type;
+            format = type == kSecItemTypeUnknown ? kSecFormatPKCS12 : kSecFormatUnknown;
+            err = SecItemImport(data.get(), path.get(), &format, &importType, 0, &params, keychain, &items.get());
+        }
+
         if (err != noErr)
         {
             ostringstream os;
@@ -421,6 +420,20 @@ namespace
             }
         }
 
+        // A certificate must expose a Subject Key Identifier to be imported into the keychain: the SKI is used
+        // both to locate an already-imported certificate (the query below) and as the key label that pairs the
+        // private key with the certificate (further down). Reject a certificate without one with a clear error
+        // instead of passing a null value to CFDictionarySetValue, which aborts the process. Certificates without
+        // a Subject Key Identifier are uncommon in practice, so rejecting them is acceptable.
+        if (!hash)
+        {
+            throw CertificateReadException(
+                __FILE__,
+                __LINE__,
+                "SSL transport: the certificate for key file '" + file +
+                    "' has no Subject Key Identifier extension and cannot be imported into the macOS keychain");
+        }
+
         const void* values[] = {keychain};
         UniqueRef<CFArrayRef> searchList(CFArrayCreate(kCFAllocatorDefault, values, 1, &kCFTypeArrayCallBacks));
 
@@ -510,8 +523,8 @@ namespace
         // kSecKeyLabel attribute should match the subject key identifier.
         //
         vector<SecKeychainAttribute> attributes;
-        if (hash)
         {
+            // hash is guaranteed non-null here: loadPrivateKey rejects certificates without a Subject Key Identifier.
             SecKeychainAttribute attr;
             attr.tag = kSecKeyLabel;
             attr.data = const_cast<UInt8*>(CFDataGetBytePtr(hash.get()));
@@ -536,7 +549,7 @@ namespace
         }
 
         SecKeychainAttributeList attrs;
-        attrs.attr = &attributes[0];
+        attrs.attr = attributes.data();
         attrs.count = static_cast<UInt32>(attributes.size());
         SecKeychainItemModifyAttributesAndData(reinterpret_cast<SecKeychainItemRef>(key.get()), &attrs, 0, nullptr);
 
@@ -594,10 +607,21 @@ namespace
                     break;
                 }
 
-                vector<byte> data(IceInternal::Base64::decode(string(&buffer[startpos], size)));
+                vector<std::byte> data;
+                try
+                {
+                    data = IceInternal::Base64::decode(string(&buffer[startpos], size));
+                }
+                catch (const std::invalid_argument&)
+                {
+                    throw InitializationException(
+                        __FILE__,
+                        __LINE__,
+                        "SSL transport: certificate " + file + " is not a valid PEM-encoded certificate");
+                }
                 UniqueRef<CFDataRef> certdata(CFDataCreate(
                     kCFAllocatorDefault,
-                    reinterpret_cast<uint8_t*>(&data[0]),
+                    reinterpret_cast<uint8_t*>(data.data()),
                     static_cast<CFIndex>(data.size())));
                 UniqueRef<SecCertificateRef> cert(SecCertificateCreateWithData(0, certdata.get()));
                 if (!cert)
@@ -681,7 +705,7 @@ Ice::SSL::SecureTransport::loadCertificateChain(
     if (!chain)
     {
         ostringstream os;
-        os << "SSL transport: couldn't find identity in file " << file;
+        os << "SSL transport: could not find identity in file " << file;
         throw InitializationException(__FILE__, __LINE__, os.str());
     }
 #else
@@ -698,7 +722,7 @@ Ice::SSL::SecureTransport::loadCertificateChain(
         if (SecCertificateGetTypeID() != CFGetTypeID(cert))
         {
             ostringstream os;
-            os << "SSL transport: couldn't find certificate in '" << file << "'";
+            os << "SSL transport: could not find certificate in '" << file << "'";
             throw CertificateReadException(__FILE__, __LINE__, os.str());
         }
 
@@ -715,21 +739,6 @@ Ice::SSL::SecureTransport::loadCertificateChain(
     return chain.release();
 }
 
-SecCertificateRef
-Ice::SSL::SecureTransport::loadCertificate(const string& file)
-{
-    UniqueRef<SecCertificateRef> cert;
-#if defined(ICE_USE_SECURE_TRANSPORT_IOS)
-    UniqueRef<CFArrayRef> certs(loadCerts(file));
-    assert(CFArrayGetCount(certs.get()) > 0);
-    cert.retain((SecCertificateRef)CFArrayGetValueAtIndex(certs.get(), 0));
-#else
-    UniqueRef<CFArrayRef> items(loadKeychainItems(file, kSecItemTypeCertificate, nullptr, ""));
-    cert.retain((SecCertificateRef)CFArrayGetValueAtIndex(items.get(), 0));
-#endif
-    return cert.release();
-}
-
 CFArrayRef
 Ice::SSL::SecureTransport::loadCACertificates(const string& file)
 {
@@ -857,7 +866,8 @@ Ice::SSL::SecureTransport::findCertificateChain(
             {
                 throw InitializationException(__FILE__, __LINE__, "SSL transport: invalid value '" + value + "'");
             }
-            UniqueRef<CFDataRef> v(CFDataCreate(kCFAllocatorDefault, &buffer[0], static_cast<CFIndex>(buffer.size())));
+            UniqueRef<CFDataRef> v(
+                CFDataCreate(kCFAllocatorDefault, buffer.data(), static_cast<CFIndex>(buffer.size())));
             CFDictionarySetValue(
                 query.get(),
                 field == "SUBJECTKEYID" ? kSecAttrSubjectKeyID : kSecAttrSerialNumber,
@@ -932,16 +942,28 @@ Ice::SSL::SecureTransport::findCertificateChain(
     if (err != noErr)
     {
         ostringstream os;
-        os << "SSL transport: couldn't create identity for certificate found in the keychain:\n"
+        os << "SSL transport: could not create identity for certificate found in the keychain:\n"
            << sslErrorToString(err);
         throw InitializationException(__FILE__, __LINE__, os.str());
     }
 
-    // Now lookup the identity with the label
+    // Now lookup the identity with the label. We match the identity by the certificate's label, so the
+    // certificate must have one; reject it with a clear error rather than passing a null value to
+    // CFDictionarySetValue (which aborts the process).
+    const void* label = CFDictionaryGetValue(attributes.get(), kSecAttrLabel);
+    if (label == nullptr)
+    {
+        throw InitializationException(
+            __FILE__,
+            __LINE__,
+            "SSL transport: could not create identity for certificate found in the keychain: the certificate has no "
+            "label attribute");
+    }
+
     query.reset(CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     CFDictionarySetValue(query.get(), kSecMatchLimit, kSecMatchLimitOne);
     CFDictionarySetValue(query.get(), kSecClass, kSecClassIdentity);
-    CFDictionarySetValue(query.get(), kSecAttrLabel, (CFDataRef)CFDictionaryGetValue(attributes.get(), kSecAttrLabel));
+    CFDictionarySetValue(query.get(), kSecAttrLabel, label);
     CFDictionarySetValue(query.get(), kSecReturnRef, kCFBooleanTrue);
     err = SecItemCopyMatching(query.get(), (CFTypeRef*)&identity.get());
     if (err == noErr)
@@ -958,7 +980,7 @@ Ice::SSL::SecureTransport::findCertificateChain(
     if (err != noErr)
     {
         ostringstream os;
-        os << "SSL transport: couldn't create identity for certificate found in the keychain:\n"
+        os << "SSL transport: could not create identity for certificate found in the keychain:\n"
            << sslErrorToString(err);
         throw InitializationException(__FILE__, __LINE__, os.str());
     }

data/dist/ice/cpp/src/Ice/SSL/SecureTransportUtil.h

@@ -13,13 +13,6 @@ namespace Ice::SSL::SecureTransport
     std::string sslErrorToString(CFErrorRef);
     std::string sslErrorToString(OSStatus);
 
-#    if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-    //
-    // Retrieve a certificate property
-    //
-    CFDictionaryRef getCertificateProperty(SecCertificateRef, CFTypeRef);
-#    endif
-
     //
     // Read certificate from a file.
     //
@@ -30,7 +23,6 @@ namespace Ice::SSL::SecureTransport
         const std::string&,
         const std::string&);
 
-    SecCertificateRef loadCertificate(const std::string&);
     ICE_API CFArrayRef loadCACertificates(const std::string&);
     ICE_API CFArrayRef findCertificateChain(const std::string&, const std::string&, const std::string&);
 

data/dist/ice/cpp/src/Ice/Selector.cpp

@@ -127,10 +127,10 @@ Selector::getNextHandler(SocketOperation& status, DWORD& count, int& error, int
             }
             else
             {
-                // This indicates a internal error with the IOCP completion port, we log the error and abort.
+                // This indicates an internal error with the IOCP completion port, we log the error and abort.
                 Ice::SocketException ex(__FILE__, __LINE__, err);
                 Ice::Error out(_instance->initializationData().logger);
-                out << "couldn't dequeue packet from completion port:\n" << ex;
+                out << "could not dequeue packet from completion port:\n" << ex;
                 std::abort();
             }
         }
@@ -478,7 +478,7 @@ Selector::startSelect()
 
     //
     // If there are ready handlers, don't block in select, just do a non-blocking
-    // select to retrieve new ready handlers from the Java selector.
+    // select to retrieve new ready handlers from the selector.
     //
     _selectNow = !_readyHandlers.empty();
 }
@@ -556,7 +556,7 @@ Selector::select(int timeout)
     }
     else if (timeout > 0)
     {
-        // kqueue use seconds, epoll use milliseconds
+        // kqueue uses seconds, epoll uses milliseconds
 #    ifdef ICE_USE_EPOLL
         timeout = timeout * 1000;
 #    endif
@@ -570,17 +570,17 @@ Selector::select(int timeout)
     while (true)
     {
 #    if defined(ICE_USE_EPOLL)
-        _count = epoll_wait(_queueFd, &_events[0], _events.size(), timeout);
+        _count = epoll_wait(_queueFd, _events.data(), _events.size(), timeout);
 #    else // ICE_USE_KQUEUE
         assert(!_events.empty());
         if (timeout >= 0)
         {
             timespec ts{.tv_sec = timeout, .tv_nsec = 0};
-            _count = kevent(_queueFd, nullptr, 0, &_events[0], static_cast<int>(_events.size()), &ts);
+            _count = kevent(_queueFd, nullptr, 0, _events.data(), static_cast<int>(_events.size()), &ts);
         }
         else
         {
-            _count = kevent(_queueFd, nullptr, 0, &_events[0], static_cast<int>(_events.size()), nullptr);
+            _count = kevent(_queueFd, nullptr, 0, _events.data(), static_cast<int>(_events.size()), nullptr);
         }
 #    endif
 
@@ -591,7 +591,7 @@ Selector::select(int timeout)
                 continue;
             }
 
-            // This indicates a internal error with the selector, we log the error and abort.
+            // This indicates an internal error with the selector, we log the error and abort.
             Ice::SocketException ex(__FILE__, __LINE__, IceInternal::getSocketErrno());
             Ice::Error out(_instance->initializationData().logger);
             out << "selector failed:\n" << ex;
@@ -640,9 +640,9 @@ Selector::updateSelector()
 {
     int rs = kevent(
         _queueFd,
-        &_changes[0],
+        _changes.data(),
         static_cast<int>(_changes.size()),
-        &_changes[0],
+        _changes.data(),
         static_cast<int>(_changes.size()),
         &zeroTimeout);
     if (rs < 0)
@@ -1120,6 +1120,9 @@ Selector::finish(EventHandler* handler, bool closeNow)
 void
 Selector::ready(EventHandler* handler, SocketOperation status, bool value)
 {
+    // Hold _mutex across the read-modify-write of handler->_ready. The run-loop thread reads _ready under _mutex
+    // (in startSelect/finishSelect, via EventHandlerWrapper), so updating it unlocked here would be a data race.
+    lock_guard lock(_mutex);
     if (((handler->_ready & status) != 0) == value)
     {
         return; // Nothing to do if ready state already correctly set.
@@ -1134,7 +1137,6 @@ Selector::ready(EventHandler* handler, SocketOperation status, bool value)
         handler->_ready = static_cast<SocketOperation>(handler->_ready & ~status);
     }
 
-    lock_guard lock(_mutex);
     std::map<EventHandler*, EventHandlerWrapperPtr>::iterator p = _wrappers.find(handler);
     assert(p != _wrappers.end());
     p->second->checkReady();

data/dist/ice/cpp/src/Ice/ServantManager.cpp

@@ -184,7 +184,7 @@ IceInternal::ServantManager::findServant(const Identity& ident, const string_vie
     lock_guard lock(_mutex);
 
     //
-    // This assert is not valid if the adapter dispatch incoming
+    // This assert is not valid if the adapter dispatches incoming
     // requests from bidir connections. This method might be called if
     // requests are received over the bidir connection after the
     // adapter was deactivated.
@@ -277,7 +277,7 @@ IceInternal::ServantManager::hasServant(const Identity& ident) const
     lock_guard lock(_mutex);
 
     //
-    // This assert is not valid if the adapter dispatch incoming
+    // This assert is not valid if the adapter dispatches incoming
     // requests from bidir connections. This method might be called if
     // requests are received over the bidir connection after the
     // adapter was deactivated.
@@ -360,7 +360,7 @@ IceInternal::ServantManager::findServantLocator(const string_view category) cons
     lock_guard lock(_mutex);
 
     //
-    // This assert is not valid if the adapter dispatch incoming
+    // This assert is not valid if the adapter dispatches incoming
     // requests from bidir connections. This method might be called if
     // requests are received over the bidir connection after the
     // adapter was deactivated.