Double Free in Chi with Mutual Tls

A Double Free occurs when a program attempts to free the same dynamically allocated memory twice. In the context of Chi, a small HTTP framework for Go, this typically arises when request-scoped objects or response writers are incorrectly managed across middleware or handlers. When combined with Mutual TLS (mTLS), the interaction can expose or exacerbate memory safety issues under specific conditions, especially when connection state is reused or terminated abruptly.

With mTLS enabled, Chi establishes a bidirectional authenticated TLS channel. The framework verifies client certificates on each request. If a handler or middleware does not properly guard against releasing resources after an early close or an error, the same memory region (e.g., a context value or a custom response wrapper) can be freed when the TLS connection closes and then freed again during cleanup or garbage-finalization steps. This is more likely when developers tie request lifetime objects to the TLS connection state and fail to ensure single ownership.

Consider a scenario where a middleware attaches a large buffer to the request context for processing under mTLS. If an error triggers an early http.CloseNotifier-style cleanup or the handler calls http.Flusher in an unconventional way while the TLS handshake is still in a transitional state, the same buffer might be released by the framework’s internal teardown and then explicitly released by user code. The result is a use-after-free pattern that can corrupt heap metadata, leading to crashes or potential code execution when the connection is reused or inspected via side channels.

Chi’s runtime does not inherently introduce Double Free; the risk comes from how developers model state across the mTLS handshake and request lifecycle. For example, storing a pointer in a context that is later retrieved after the underlying TLS connection has been closed can create a stale reference. If that reference is then used to free memory (explicitly or via finalizers), and the same memory is also freed by Chi’s own request teardown, a double free occurs. This is why testing under mTLS with abrupt client disconnects or renegotiations is important to surface such issues.

Real-world analogies include CVE scenarios where improper resource handling in HTTP servers leads to memory corruption. While Chi itself does not implement TLS, it relies on Go’s crypto/tls, and the integration means developers must ensure that any cleanup logic is idempotent and does not assume ownership across connection boundaries.

To prevent Double Free and similar memory-safety issues in Chi when using Mutual TLS, focus on strict ownership semantics, idempotent cleanup, and avoiding storing references beyond the request lifetime. Below are concrete patterns and code examples.

1. Avoid attaching mutable state to context that outlives the request

Do not store pointers to heap-allocated objects in Chi’s request context that you manually manage. If you must, ensure they are allocated per-request and not shared across goroutines or reused after the request ends.

// Chi handler with safe per-request buffer
func uploadHandler(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        // Allocate fresh buffer for this request only
        buf := make([]byte, 0, 1024)
        // Use context.WithValue only if necessary; prefer passing via closure
        ctx := context.WithValue(r.Context(), &bufferKey{}, buf)
        r = r.WithContext(ctx)
        next.ServeHTTP(w, r)
        // No explicit free; Go GC handles buf after handler returns
    })
}

2. Ensure idempotent cleanup and avoid finalizers on TLS-bound objects

Do not register finalizers or close resources in a way that can be invoked multiple times. Use sync.Once or guard flags if you must clean up external resources tied to TLS state.

// Safe teardown pattern for TLS-associated resources
type tlsState struct {
    conn   net.Conn
    cleanupOnce sync.Once
}

func (s *tlsState) safeClose() {
    s.cleanupOnce.Do(func() {
        if s.conn != nil {
            s.conn.Close()
        }
    })
}

// In a Chi middleware using mTLS
func mTLSMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        state := &tlsState{conn: r.TLS().ConnectionState().PeerCertificates}
        defer state.safeClose()
        next.ServeHTTP(w, r)
    })
}

3. Validate client certificate state before using stored references

When mTLS is active, ensure that any reference derived from the TLS handshake is validated for freshness before use. Do not assume the connection or certificate remains valid after the request returns.

// Verify certificate validity before use in Chi
func verifyClientCert(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if r.TLS != nil && r.TLS.VerifiedChains != nil && len(r.TLS.VerifiedChains) > 0 {
            // Safe to use certificate data within this request scope
            cert := r.TLS.VerifiedChains[0][0]
            _ = cert // process cert safely
            next.ServeHTTP(w, r)
        } else {
            http.Error(w, "mTLS verification failed", http.StatusUnauthorized)
        }
    })
}

4. Prefer composition over context mutation for request-scoped data

Instead of mutating context with pointers, pass data via closures or dedicated request-scoped structs that are discarded after the request. This eliminates the risk of double-free across middleware boundaries.

// Composable approach to avoid context misuse
type requestParams struct {
    UserID string
    Buffer []byte
}

func withParams(next func(http.ResponseWriter, *http.Request, requestParams)) http.HandlerFunc {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        params := requestParams{
            UserID: r.Header.Get("X-User-ID"),
            Buffer: make([]byte, 256),
        }
        next(w, r, params)
    })
}

// Usage in Chi router
r := chi.NewRouter()
r.Use(withParams)
r.Get("/", func(w http.ResponseWriter, r *http.Request, p requestParams) {
    // p is a copy per request; no manual free needed
    _ = p
})

5. Test under mTLS with abrupt disconnects

Use real TLS clients that terminate connections mid-handshake or after partial requests to ensure Chi’s internal state does not leave dangling pointers. Combine with race detector to catch data races that may indicate double-free risks.

// Example test client with mTLS and early close
func testEarlyClose() {
    tlsConfig := &tls.Config{
        Certificates: []tls.Certificate{clientCert},
        RootCAs:      caCertPool,
    }
    conn, err := tls.Dial("tcp", "localhost:8080", tlsConfig)
    if err != nil {
        log.Fatal(err)
    }
    conn.Close() // abrupt close under mTLS
}