Keep X509 handle alive while in use when reading certificate data

[vcsjones]

The X509 certificate reader for OpenSSL does several operations in two steps. First, get a pointer to some interior data of the X509* object, and then pass that pointer off to some other API that knows how to interpret the data that is in the pointer.

If the X509SafeHandle is freed between these two steps, then the interior data pointer no longer points to valid data. This change keeps the SafeX509Handle and the X509 OpenSSL object alive while it is in use. This prevents crashes if a X509Certificate2 object is being used while it is in the middle of being disposed.

This also adds a specific test that tries to reproduce the issue. It will rarely get hit, but often enough that it would show up as a flaky test very soon if the behavior regresses.

PR is best reviewed ignoring white space.

Closes #49732

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

The X509 certificate reader in for OpenSSL does several operations in two steps. First, get a pointer to some interior data of the X509* object, and then pass that pointer off to some other API that knows how to interpret the data that is in the pointer.

If the X509SafeHandle is freed between these two steps, then the interior data pointer no longer points to valid data. This change keeps the SafeX509Handle and the X509 OpenSSL object alive while it is in use. This prevents crashes if a X509Certificate2 object is being used while it is in the middle of being disposed.

This also adds a specific test that tries to reproduce the issue. It will rarely get hit, but often enough that it would show up as a flaky test very soon if the behavior regresses.

PR is best reviewed ignoring white space.

Closes #49732

Author:	vcsjones
Assignees:	-
Labels:	area-System.Security, community-contribution
Milestone:	-

[vcsjones]

That test failed about 1/2000 runs for me. I let it run several million times after making the associated changes and was no longer able to reproduce the issue.