[openssl-users] Correct way to free SSL_CTX* ?

Mon Jan 29 03:05:13 UTC 2018

Hi all,

I'm trying to write an application in which I create an instance of
SSL_CTX* using SSL_CTX_new(), and set the following things in it:

(1) An EVP_PKEY* :
1a> created with PEM_read_bio_PrivateKey().
1b> set in the ctx using SSL_CTX_use_PrivateKey().

(2) A number of X509* instances (cuz chained certs) :
2a> all created with PEM_read_bio_X509().
2b> set in the ctx using SSL_CTX_use_certificate() or
SSL_CTX_add_extra_chain_cert().

At the end, I use SSL_CTX_free() to free up the ctx. According to the man
page for SSL_CTX_free():

"SSL_CTX_free() decrements the reference count of ctx, and removes the
SSL_CTX object pointed to by ctx and frees up the allocated memory if the
the reference count has reached 0.
       It also calls the free()ing procedures for indirectly affected
items, if applicable: the session cache, the list of ciphers, the list of
Client CAs, the certificates and keys. "

... which tells me that freeing the SSL_CTX should free up its memory as
well as the things I set inside of it (unless I'm interpreting it super
wrong?) like " ... certificates and keys".
The problem is, when run my application under valgrind, I keep seeing
memory leaks for both steps (1a) and (2a).

I tried to get rid of them, by using EVP_PKEY_free() after I'm done setting
in step (1b). This works, and the leak for step (1a) goes away.
When I try to do the same for step (2), i.e. calling X509_free() after
every successful "set" call, I get a coredump (backtrace is attached:
bt_1.txt), coming out of SSL_CTX_free, suggesting that I did something
wrong.

Which brings me to my question, does anyone know the correct way to free
memory in SSL_CTX ? Or, what's wrong with my steps? The application doesn't
even perform SSL yet, I'm just trying to create/destroy SSL_CTX objects
without leaks first. Any help would be appreciated!

Thanks in advance,
-Pratyush.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20180128/1ce3cda4/attachment.html>
-------------- next part --------------
Leak when I don't free the X509* objects manually.
Line test_ssl_leak.cpp:241 actually has a call to PEM_read_bio_X509.

==27639== 
==27639== HEAP SUMMARY:
==27639==     in use at exit: 163,236 bytes in 2,948 blocks
==27639==   total heap usage: 5,063 allocs, 2,115 frees, 398,442 bytes allocated
==27639== 
==27639== 3,659 (184 direct, 3,475 indirect) bytes in 1 blocks are definitely lost in loss record 278 of 282
==27639==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==27639==    by 0x5105E77: CRYPTO_malloc (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==27639==    by 0x51E1443: asn1_item_ex_combine_new (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==27639==    by 0x51E3EB0: ASN1_item_ex_d2i (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==27639==    by 0x51E449A: ASN1_item_d2i (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==27639==    by 0x51F33AD: PEM_ASN1_read_bio (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==27639==    by 0x4173B8: makeDataSSLCtx(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (test_ssl_leak.cpp:241)
==27639==    by 0x417BE0: test_ssl_leak() (test_ssl_leak.cpp:487)
==27639==    by 0x4083CE: main (test2.cpp:53)
==27639== 
==27639== LEAK SUMMARY:
==27639==    definitely lost: 184 bytes in 1 blocks
==27639==    indirectly lost: 3,475 bytes in 94 blocks
==27639==      possibly lost: 0 bytes in 0 blocks
==27639==    still reachable: 159,577 bytes in 2,853 blocks
==27639==         suppressed: 0 bytes in 0 blocks
==27639== Reachable blocks (those to which a pointer was found) are not shown.
==27639== To see them, rerun with: --leak-check=full --show-leak-kinds=all

==========================================================================================================================
Core dump after I do call X509_free after a successful call to SSL_CTX_use_certificate() or SSL_CTX_add_extra_chain_cert()

#0  ASN1_STRING_free (a=0x40) at asn1_lib.c:428
#1  0x00007f53f2fa5675 in ASN1_primitive_free (pval=<optimized out>, it=<optimized out>) at tasn_fre.c:244
#2  0x00007f53f2fa5aaf in ASN1_template_free (pval=0x1627060, tt=tt at entry=0x7f53f3295970 <X509_seq_tt+80>) at tasn_fre.c:191
#3  0x00007f53f2fa57e2 in asn1_item_combine_free (pval=pval at entry=0x7ffe273ef1a8, it=0x7f53f328eb20 <X509_it>, combine=combine at entry=0) at tasn_fre.c:166
#4  0x00007f53f2fa59f5 in ASN1_item_free (val=0x1627050, it=<optimized out>) at tasn_fre.c:72
#5  0x00007f53f2f81041 in sk_pop_free (st=0x1628520, func=0x405380 <X509_free at plt>) at stack.c:327
#6  0x00007f53f32e8da7 in SSL_CTX_free (a=0x16249d0) at ssl_lib.c:2152
#7  0x0000000000417d69 in std::unique_ptr<ssl_ctx_st, void (*)(ssl_ctx_st*)>::reset (this=0x7ffe273ef220, __p=0x16249d0) at /usr/include/c++/5/bits/unique_ptr.h:344
#8  0x0000000000417c33 in test_ssl_leak () at ../src/test_ssl_leak.cpp:492
#9  0x00000000004083cf in main () at ../src/test2.cpp:53