]> git.ipfire.org Git - thirdparty/strongswan.git/commit
leak-detective: Add whitelist entries for AWS-LC
authorGerardo Ravago <gcr@amazon.com>
Wed, 6 Mar 2024 15:45:00 +0000 (10:45 -0500)
committerTobias Brunner <tobias@strongswan.org>
Thu, 7 Mar 2024 14:06:40 +0000 (15:06 +0100)
commit8237968c2c0cf52af3a1b1a586da5d0bddb2b2c1
tree2a442b65cd20e0af990c73e5e25eb0e3e603133e
parent44e241fccc166211ccfdd322047c1213ff3ae73c
leak-detective: Add whitelist entries for AWS-LC

AWS-LC (and likely BoringSSL) uses thread specific data to store internal
library state which gets freed via a registered destructor when the thread
terminates. If this thread happens to be the main thread, which runs the
leak-detective evaluation, the detective won't observe the corresponding free
of the related memory and erroneously reports it as a leak.

The two places this happens are:
- `RAND_bytes` for storing internal RNG state.
- `ERR_put_error` for storing the per-thread OpenSSL error queue.

References strongswan/strongswan#1907
Closes strongswan/strongswan#2147
src/libstrongswan/utils/leak_detective.c