From fd0426814d9ebd1ece5455fc44925d34471a654a Mon Sep 17 00:00:00 2001
From: Bryan Biedenkapp <gatekeep@gmail.com>
Date: Mon, 12 Oct 2026 20:40:15 -0400
Subject: [PATCH] correct crash condition that can be caused by retrieving KMF
 keys;

---
 src/fne/CryptoContainer.cpp | 77 +++++++++++++++++++++++++++++++++++--
 src/fne/CryptoContainer.h   | 49 +++++++++++++++--------
 2 files changed, 107 insertions(+), 19 deletions(-)

diff --git a/src/fne/CryptoContainer.cpp b/src/fne/CryptoContainer.cpp
index 93c9a193..ed8e5ed3 100644
--- a/src/fne/CryptoContainer.cpp
+++ b/src/fne/CryptoContainer.cpp
@@ -376,6 +376,62 @@ EKCKeyItem CryptoContainer::findLLA(uint32_t rsi)
     return entry;
 }
 
+/* Returns the last load time of this lookup table. */
+
+uint64_t CryptoContainer::lastLoadTime() const
+{
+    std::lock_guard<std::mutex> lock(s_mutex);
+    return m_lastLoadTime;
+}
+
+/* Returns thread-safe snapshots of the crypto tables. */
+
+std::vector<EKCKeyItem> CryptoContainer::keys() const
+{
+    std::lock_guard<std::mutex> lock(s_mutex);
+    return m_keys;
+}
+
+/* Sets thread-safe snapshots of the crypto tables. */
+
+void CryptoContainer::keys(std::vector<EKCKeyItem> val)
+{
+    std::lock_guard<std::mutex> lock(s_mutex);
+    m_keys = std::move(val);
+}
+
+/* Returns thread-safe snapshots of the UKEK RSI keys. */
+
+std::vector<EKCKeyItem> CryptoContainer::ukeks() const
+{
+    std::lock_guard<std::mutex> lock(s_mutex);
+    return m_ukeks;
+}
+
+/* Sets thread-safe snapshots of the UKEK RSI keys. */
+
+void CryptoContainer::ukeks(std::vector<EKCKeyItem> val)
+{
+    std::lock_guard<std::mutex> lock(s_mutex);
+    m_ukeks = std::move(val);
+}
+
+/* Returns thread-safe snapshots of the LLA RSI keys. */
+
+std::vector<EKCKeyItem> CryptoContainer::llas() const
+{
+    std::lock_guard<std::mutex> lock(s_mutex);
+    return m_llas;
+}
+
+/* Sets thread-safe snapshots of the LLA RSI keys. */
+
+void CryptoContainer::llas(std::vector<EKCKeyItem> val)
+{
+    std::lock_guard<std::mutex> lock(s_mutex);
+    m_llas = std::move(val);
+}
+
 // ---------------------------------------------------------------------------
 //  Private Class Members
 // ---------------------------------------------------------------------------
@@ -779,21 +835,34 @@ bool CryptoContainer::load()
         return false;
     }
 
-    if (m_keys.size() == 0U && m_ukeks.size() == 0U && m_llas.size() == 0U) {
+    size_t keyCount = 0U;
+    size_t ukekCount = 0U;
+    size_t llaCount = 0U;
+    {
+        std::lock_guard<std::mutex> lock(s_mutex);
+        keyCount = m_keys.size();
+        ukekCount = m_ukeks.size();
+        llaCount = m_llas.size();
+    }
+
+    if (keyCount == 0U && ukekCount == 0U && llaCount == 0U) {
         ::LogError(LOG_HOST, "No encryption keys defined!");
         return false;
     }
 
-    size_t size = m_keys.size() + m_ukeks.size() + m_llas.size();
+    size_t size = keyCount + ukekCount + llaCount;
     if (size == 0U) {
         return false;
     }
 
     uint64_t now = std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::system_clock::now().time_since_epoch()).count();
-    m_lastLoadTime = now;
+    {
+        std::lock_guard<std::mutex> lock(s_mutex);
+        m_lastLoadTime = now;
+    }
 
     LogInfoEx(LOG_HOST, "Loaded %lu entries into crypto lookup table (TEK=%lu, UKEK=%lu, LLA=%lu)",
-        size, m_keys.size(), m_ukeks.size(), m_llas.size());
+        size, keyCount, ukekCount, llaCount);
 
     return true;
 #endif // !ENABLE_SSL
diff --git a/src/fne/CryptoContainer.h b/src/fne/CryptoContainer.h
index 98d693a1..bd974fc0 100644
--- a/src/fne/CryptoContainer.h
+++ b/src/fne/CryptoContainer.h
@@ -261,7 +261,7 @@ public:
      * @brief Returns the last load time of this lookup table.
      * @return const uint64_t Last load time in milliseconds since epoch.
      */
-    const uint64_t lastLoadTime() const { return m_lastLoadTime; }
+    uint64_t lastLoadTime() const;
 
     /**
      * @brief Returns the filename of this lookup table.
@@ -280,6 +280,35 @@ public:
      */
     const bool isRemoteAccessEnabled() const { return m_remoteAccessEnabled; }
 
+    /**
+     * @brief Returns a thread-safe snapshot of the keys.
+     */
+    std::vector<EKCKeyItem> keys() const;
+    /**
+     * @brief Sets the thread-safe snapshot of the keys.
+     * @param val Vector of key items to set.
+     */
+    void keys(std::vector<EKCKeyItem> val);
+
+    /**
+     * @brief Returns a thread-safe snapshot of the UKEK RSI keys.
+     */
+    std::vector<EKCKeyItem> ukeks() const;
+    /**
+     * @brief Sets the thread-safe snapshot of the UKEK RSI keys.
+     * @param val Vector of key items to set.
+     */
+    void ukeks(std::vector<EKCKeyItem> val);
+    /**
+     * @brief Returns a thread-safe snapshot of the LLA RSI keys.
+     */
+    std::vector<EKCKeyItem> llas() const;
+    /**
+     * @brief Sets the thread-safe snapshot of the LLA RSI keys.
+     * @param val Vector of key items to set.
+     */
+    void llas(std::vector<EKCKeyItem> val);
+
 private:
     std::string m_file;
     std::string m_password;
@@ -301,20 +330,10 @@ private:
      */
     bool load();
 
-public:
-    /**
-     * @brief List of keys.
-     */
-    DECLARE_PROPERTY_PLAIN(std::vector<EKCKeyItem>, keys);
-
-    /**
-     * @brief List of UKEK RSI keys.
-     */
-    DECLARE_PROPERTY_PLAIN(std::vector<EKCKeyItem>, ukeks);
-    /**
-     * @brief List of LLA RSI keys.
-     */
-    DECLARE_PROPERTY_PLAIN(std::vector<EKCKeyItem>, llas);
+private:
+    std::vector<EKCKeyItem> m_keys;
+    std::vector<EKCKeyItem> m_ukeks;
+    std::vector<EKCKeyItem> m_llas;
 };
 
 #endif // __CRYPTO_CONTAINER_H__