From 6fc83c7a2f0ff506a5912ca3e65be9a7b2e7ab8a Mon Sep 17 00:00:00 2001
From: Milos Kotlar <kotlarmilos@gmail.com>
Date: Wed, 23 Jul 2025 16:23:06 +0200
Subject: [PATCH] Lock over the same object to serialize access to the buffers

---
 .../Net/Security/Pal.OSX/SafeDeleteSslContext.cs    | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs b/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
index 9b672d7d6c3a6d..fc6daac1c1824b 100644
--- a/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
+++ b/src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs
@@ -17,6 +17,7 @@ internal sealed class SafeDeleteSslContext : SafeDeleteContext
         // mapped from OSX error codes
         private const int InitialBufferSize = 2048;
         private readonly SafeSslHandle _sslContext;
+        private readonly object _lock = new object();
         private ArrayBuffer _inputBuffer = new ArrayBuffer(InitialBufferSize);
         private ArrayBuffer _outputBuffer = new ArrayBuffer(InitialBufferSize);
 
@@ -202,7 +203,7 @@ protected override void Dispose(bool disposing)
                 SafeSslHandle sslContext = _sslContext;
                 if (null != sslContext)
                 {
-                    lock (_sslContext)
+                    lock (_lock)
                     {
                         _inputBuffer.Dispose();
                         _outputBuffer.Dispose();
@@ -225,7 +226,7 @@ private static unsafe int WriteToConnection(IntPtr connection, byte* data, void*
             // but if we were to pool the buffers we would have a potential use-after-free issue.
             try
             {
-                lock (context)
+                lock (context._lock)
                 {
                     ulong length = (ulong)*dataLength;
                     Debug.Assert(length <= int.MaxValue);
@@ -257,7 +258,7 @@ private static unsafe int ReadFromConnection(IntPtr connection, byte* data, void
 
             try
             {
-                lock (context)
+                lock (context._lock)
                 {
                     ulong toRead = (ulong)*dataLength;
 
@@ -294,7 +295,7 @@ private static unsafe int ReadFromConnection(IntPtr connection, byte* data, void
 
         internal void Write(ReadOnlySpan<byte> buf)
         {
-            lock (_sslContext)
+            lock (_lock)
             {
                 _inputBuffer.EnsureAvailableSpace(buf.Length);
                 buf.CopyTo(_inputBuffer.AvailableSpan);
@@ -306,7 +307,7 @@ internal void Write(ReadOnlySpan<byte> buf)
 
         internal void ReadPendingWrites(ref ProtocolToken token)
         {
-            lock (_sslContext)
+            lock (_lock)
             {
                 if (_outputBuffer.ActiveLength == 0)
                 {
@@ -328,7 +329,7 @@ internal int ReadPendingWrites(byte[] buf, int offset, int count)
             Debug.Assert(count >= 0);
             Debug.Assert(count <= buf.Length - offset);
 
-            lock (_sslContext)
+            lock (_lock)
             {
                 int limit = Math.Min(count, _outputBuffer.ActiveLength);