{"record":{"id":"adcee774cdec0546","repo":"shadowsocks/shadowsocks-windows","slug":"openssl-fail-to-create-ctx","errorCode":null,"errorMessage":"openssl: fail to create ctx","messagePattern":"openssl: fail to create ctx","errorType":"exception","errorClass":"System.Exception","httpStatus":null,"severity":"critical","filePath":"shadowsocks-csharp/Encryption/AEAD/AEADOpenSSLEncryptor.cs","lineNumber":52,"sourceCode":"        };\r\n\r\n        public static List<string> SupportedCiphers()\r\n        {\r\n            return new List<string>(_ciphers.Keys);\r\n        }\r\n\r\n        protected override Dictionary<string, EncryptorInfo> getCiphers()\r\n        {\r\n            return _ciphers;\r\n        }\r\n\r\n        public override void InitCipher(byte[] salt, bool isEncrypt, bool isUdp)\r\n        {\r\n            base.InitCipher(salt, isEncrypt, isUdp);\r\n            _cipherInfoPtr = OpenSSL.GetCipherInfo(_innerLibName);\r\n            if (_cipherInfoPtr == IntPtr.Zero) throw new System.Exception(\"openssl: cipher not found\");\r\n            IntPtr ctx = OpenSSL.EVP_CIPHER_CTX_new();\r\n            if (ctx == IntPtr.Zero) throw new System.Exception(\"openssl: fail to create ctx\");\r\n\r\n            if (isEncrypt)\r\n            {\r\n                _encryptCtx = ctx;\r\n            }\r\n            else\r\n            {\r\n                _decryptCtx = ctx;\r\n            }\r\n\r\n            DeriveSessionKey(isEncrypt ? _encryptSalt : _decryptSalt, _Masterkey,\r\n                isEncrypt ? _opensslEncSubkey : _opensslDecSubkey);\r\n\r\n            var ret = OpenSSL.EVP_CipherInit_ex(ctx, _cipherInfoPtr, IntPtr.Zero, null, null,\r\n                isEncrypt ? OpenSSL.OPENSSL_ENCRYPT : OpenSSL.OPENSSL_DECRYPT);\r\n            if (ret != 1) throw new System.Exception(\"openssl: fail to init ctx\");\r\n\r\n            ret = OpenSSL.EVP_CIPHER_CTX_set_key_length(ctx, keyLen);\r","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/shadowsocks/shadowsocks-windows/blob/891d971682eefcaa2e640258d3b352a3ad3b2233/shadowsocks-csharp/Encryption/AEAD/AEADOpenSSLEncryptor.cs#L34-L70","documentation":"Thrown from AEADOpenSSLEncryptor.InitCipher when OpenSSL.EVP_CIPHER_CTX_new returns IntPtr.Zero, meaning OpenSSL could not allocate a new cipher context. Allocation failure is almost always a sign of an uninitialized or broken OpenSSL library (the context struct is tiny, so genuine out-of-memory is rare).","triggerScenarios":"OpenSSL was not initialised (no OPENSSL_init_crypto / legacy init) before EVP_CIPHER_CTX_new; the native library failed to load or was already torn down; calling into OpenSSL after it was globally cleaned up.","commonSituations":"Mixing OpenSSL versions across native deps; calling crypto after EVP_cleanup/atexit; a DLL hijack loading the wrong libcrypto; process shutdown racing with crypto teardown.","solutions":["Ensure OpenSSL is initialised before any crypto call (modern OpenSSL auto-inits, but check for explicit cleanup elsewhere).","Confirm the correct libcrypto is loaded (no DLL hijack / wrong bitness).","Avoid calling crypto during process shutdown / after global cleanup.","If it persists, switch to the mbedTLS backend."],"exampleFix":"// before\nIntPtr ctx = OpenSSL.EVP_CIPHER_CTX_new();\nif (ctx == IntPtr.Zero) throw new System.Exception(\"openssl: fail to create ctx\");\n\n// after\nIntPtr ctx = OpenSSL.EVP_CIPHER_CTX_new();\nif (ctx == IntPtr.Zero)\n    throw new System.Exception(\"openssl: fail to create ctx (library not initialised or wrong libcrypto loaded)\");","handlingStrategy":"fallback","validationCode":"// Ensure OpenSSL is usable before relying on it\nIntPtr probe = OpenSSL.EVP_CIPHER_CTX_new();\nif (probe == IntPtr.Zero) /* fall back to mbedTLS */\nelse OpenSSL.EVP_CIPHER_CTX_free(probe);","typeGuard":"bool OpenSSLReady() => OpenSSL.EVP_CIPHER_CTX_new() != IntPtr.Zero;","tryCatchPattern":"try { useOpenSSL(); }\ncatch (Exception ex) when (ex.Message.Contains(\"fail to create ctx\"))\n{ /* fall back to mbedTLS backend; likely OpenSSL not initialised/wrong lib */ }","preventionTips":["Load the correct libcrypto (matching bitness and version).","Avoid calling crypto during process teardown.","Prefer the mbedTLS backend if OpenSSL init is unreliable in your host."],"tags":["encryption","aead","openssl","context","native-library"],"backgroundTag":null,"analyzedSha":"891d971682eefcaa2e640258d3b352a3ad3b2233","analyzedAt":"2026-08-13T10:12:34.434Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}