openssl: fix DER buffer leak in Apple SecTrust verification - #22631
tcpreplay-dev wants to merge 2 commits into
Conversation
`ossl_chain_get_der()` allocates a DER encoding of each peer certificate via `i2d_X509()`, but `Curl_vtls_apple_verify()` only copies it into a CFData and never frees the original. This leaks per certificate, per handshake, whenever USE_APPLE_SECTRUST is used with the OpenSSL/LibreSSL/BoringSSL backend. Fix frees the buffer inside openssl.c itself, so the GnuTLS backend (which borrows rather than allocates) is unaffected.
Only called twice, so no need for a function call. As per code review.
d0198df to
56177d7
Compare
|
@vszakats this CM integration windows-2022 fail looks like a new problem (and is not the fault of this PR) |
There was a problem hiding this comment.
Pull request overview
Fixes a DER certificate buffer leak during OpenSSL-backed Apple SecTrust verification.
Changes:
- Tracks the most recently allocated DER buffer.
- Frees DER memory between certificates and after verification.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Thanks! |
I would recommend a cherry-pick of 7f964b into that PR. It is cleaner than the suggested fixes (no copy/paste) and a cherry-pick gives proper credit. |
I don't follow, is this regarding the GitHub fix? can you say what to cherry-pick and whom to credit? |
Oh, I think I misunderstood the process. I think you are saying that even though this is closed, it will still land. Disregard my comments. |
|
already landed 961c95f |
ossl_chain_get_der()allocates a DER encoding of each peer certificate viai2d_X509(), butCurl_vtls_apple_verify()only copies it into a CFData and never frees the original. This leaks per certificate, per handshake, whenever USE_APPLE_SECTRUST is used with the OpenSSL/LibreSSL/BoringSSL backend.Fix frees the buffer inside openssl.c itself, so the GnuTLS backend (which borrows rather than allocates) is unaffected.
In our macOS application this patch reduced memory growth from ~65 - 67 MB/day to ~0.6 - 0.7 MB/day.