Skip to content

Revert "Fix memory leak in rs256_from_coords" #162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
djw8605 merged 1 commit into from
Dec 8, 2025
Merged

Revert "Fix memory leak in rs256_from_coords" #162

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/scitokens_internal.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,6 +532,8 @@ std::string rs256_from_coords(const std::string &e_str,
throw UnsupportedKeyException("Failed to serialize RSA public key");
}
#endif
e_bignum.release();
n_bignum.release();
Comment on lines +535 to +536
Copy link
Contributor

@DrDaveD DrDaveD Jun 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It sure is counter intuitive that adding back releases will fix a free() error, or for that matter deleting them in the original PR fixed a memory leak. One would think the opposite, that calling release() could fix a memory leak and removing it could fix a double-free error.

Copy link
Contributor Author

@djw8605 djw8605 Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since those variables are unique_ptr, release() in this context actually means for the unique_ptr to stop managing the pointer. So, effectively, it's leaking memory. But really, it must be passing it over to OpenSSL library somewhere.

Sometimes I am envious of memory safe languages like go, or the ownership mechanics of rust.

Copy link
Contributor

@GregThain GregThain Jul 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this a difference in memory ownership between openssl v1 and openssl v3? Perhaps the .releases belong in the openssl v3 ifdef?

Note that I put the .releases there because of an observed memory leak, but I only tested on a openssl v3 system.


char *mem_data;
size_t mem_len = BIO_get_mem_data(pubkey_bio.get(), &mem_data);
Expand Down
Loading