Skip to content

mbedtls not safe for multithreaded #3

Closed

Description

Hey!
Currently, as far as my understanding goes, with the macro MBEDTLS_THREADING_C not enabled by default, mbedtls will not run in a thread-safe manner. [1][2] This in turn causes issues when making multiple requests at once to inconsistently crash at runtime with hard to debug C-land errors, such as double free or corruption (fasttop), segfaults and malloc_consolidate(): unaligned fastbin chunk detected among others.

The way to resolve it would be to enable said macro, alongside MBEDTLS_THREADING_PTHREAD[2] or, potentially, MBEDTLS_THREADING_ALT[4] in the case that pthread is, for some reason, not desired.

The fix is a one liner, but I wanted to raise it as an issue first before making a PR for it, due to the following questions:

  • Should multithreading be on by default? I believe the best way of introducing it on by default, but with the ability to turn it off with a build option as there are benefits to not enabling it, such as shipping less code and less dependencies.
  • Would pthreads break Windows compatibility? This is something I am unable to answer due to not having a Windows machine at hand and not really being knowledgeable on the matter. That being said, we already are linking against pthreads[5] so I guess this won't be a big issue.

[1] - https://mbed-tls.readthedocs.io/projects/api/en/development/api/file/crypto__config_8h/#c.MBEDTLS_THREADING_C
[2] - https://mbed-tls.readthedocs.io/projects/api/en/development/api/file/crypto__config_8h/#c.MBEDTLS_THREADING_PTHREAD
[3] - https://curl.se/libcurl/c/threadsafe.html#:~:text=mbedTLS%20can%20be%20used%20safely%20in%20a%20multi%2Dthreaded%20environment%20provided%20that%20mbedTLS%20is%20compiled%20with%20MBEDTLS%5FTHREADING%5FC%20enabled%2E
[4] - https://mbed-tls.readthedocs.io/projects/api/en/development/api/file/crypto__config_8h/#c.MBEDTLS_THREADING_ALT
[5] -

curl/build.zig

Lines 228 to 231 in 6b43eca

if (enable_threaded_resolver) {
curl.root_module.addCMacro("HAVE_PTHREAD_H", "1");
curl.root_module.linkSystemLibrary("pthread", .{});
}

Activity

  1. techatrix commented on Jan 25, 2026

    @techatrix
    Member

    Enabling threading when building mbedtls as part of curl makes sense to me.
    Does #4 fix your issue?

  2. techatrix commented on Jan 25, 2026

    @techatrix
    Member

    I could not find any occurrence in the curl source code where it checks for MBEDTLS_THREADING_C. I also don't see how that could even affect anything since the curl compilation unit(s) cannot observe with what flags mbedtls was built with.

    The closest this I could find is this check that is present in versions of curl before 8.18:
    https://github.com/curl/curl/blob/400fffa90f30c7a2dc762fa33009d24851bd2016/lib/vtls/mbedtls.c#L110-L113

    Do you have a reproduction of your issue that I could take a look at?

  3. techatrix commented on Jan 26, 2026

    @techatrix
    Member

    In the absence of a reproduction or any actionable issue regarding allyourcodebase/curl, I am gong to close this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions