OpenSSL modules not freed

[pohly05]

I'm not sure why this behaviour happens, but I detected a Memory leak in CURL (7.44.0 - but I think it's the same with 7.45.0) with OpenSSL in a Win32 application on Windows 7.

Curl_ossl_init calls OPENSSL_load_builtin_modules() but Curl_ossl_cleanup doesn't make a call to free these modules.

openssl.c: 697
int Curl_ossl_init(void)
{
OPENSSL_load_builtin_modules();
...

I was able to fix that by adding CONF_modules_free(); at the end of Curl_ossl_cleanup.

Here's the main part of the Stacktrace:
module_add(dso_st * dso, const char * name, int (conf_imodule_st *, const conf_st *) * ifunc, void (conf_imodule_st *) * ffunc) Zeile 282 C
CONF_module_add(const char * name, int (conf_imodule_st *, const conf_st *) * ifunc, void (conf_imodule_st *) * ffunc) Zeile 463 C
ASN1_add_oid_module() Zeile 100 C
OPENSSL_load_builtin_modules() Zeile 78 C
Curl_ossl_init() Zeile 706 C
Curl_ssl_init() Zeile 266 C
curl_global_init(long flags) Zeile 239 C
setupGlobalConstants(_xmlrpc_env * const envP) Zeile 1508 C
callTransportSetup(_xmlrpc_env * const envP, void (_xmlrpc_env * const) * setupFn) Zeile 93 C
setupTransportGlobalConst(_xmlrpc_env * const envP) Zeile 109 C
xmlrpc_client_setup_global_const(_xmlrpc_env * const envP) Zeile 167 C
xmlrpc_client_init2(_xmlrpc_env * const envP, const int flags, const char * const appname, const char * const appversion, const xmlrpc_clientparms * const clientparmsP, const unsigned int parmSize) Zeile 38 C
XmlRpcClient::Initialize(std::basic_string<char,std::char_traits,std::allocator > appname, std::basic_string<char,std::char_traits,std::allocator > appversion, std::basic_string<char,std::char_traits,std::allocator > cainfo) Zeile 313 C++

[jay]

Confirmed in Windows 7 x64 with OpenSSL_1_0_2d and curl master f322ca7 2015-11-13 curl-all.sln VS2010 in configuration 'DLL Debug - DLL OpenSSL|Win32'. Happens regardless of whether a conf file is present.

This can be solved by either unloading the modules or freeing them on cleanup. OpenSSL's doc says:

Normally applications will only call CONF_modules_free() at application to tidy up any configuration performed.

I'm sure they mean application closedown because they say so in OPENSSL_config. Even though we don't use that function we're doing pretty much the same thing so it makes sense that we would have to use CONF_modules_free.

Thanks, landed in ad2d517.

[bagder]

FYI, I also posted the missing details for the OPENSSL_load_builtin_modules docs to OpenSSL: https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=4139