From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Wed, 18 Jul 2018 19:39:39 +0000 (-0400)
Subject: The leak occurs outside of SSL_CTX_new
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cd8f457d518ce186d16039d445fedc7b94252dc4;p=thirdparty%2Ffreeradius-server.git

The leak occurs outside of SSL_CTX_new
---

diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h
index 64324ecf21e..3150d6a4e88 100644
--- a/src/lib/tls/base-h
+++ b/src/lib/tls/base-h
@@ -454,7 +454,7 @@ extern _Thread_local TALLOC_CTX *ssl_talloc_ctx;
  * @param _expr		The call to the OpenSSL function and storage of the
  *			result.
  */
-#define SSL_BIND_MEMORY(_expr) \
+#define SSL_BIND_OBJ_MEMORY(_expr) \
 do { \
 	void *_nmem; \
 	MEM(ssl_talloc_ctx = talloc_init(STRINGIFY(_expr))); \
@@ -467,6 +467,20 @@ do { \
 	ssl_talloc_ctx = NULL; \
 } while (0)
 
+/** Bind all memory allocated from this point until the next instance of SSL_BIND_MEMORY_END to _obj
+ *
+ * @param[in] _obj	to bind memory to.
+ */
+#define SSL_BIND_MEMORY_BEGIN(_obj) \
+do { \
+	if (!fr_cond_assert(!ssl_talloc_ctx && (_obj))) { \
+		MEM(ssl_talloc_ctx = talloc_init(STRINGIFY(_obj))); \
+		talloc_steal(_obj, ssl_talloc_ctx); \
+	} \
+} while(0)
+
+#define SSL_BIND_MEMORY_END ssl_talloc_ctx = NULL
+
 /*
  *	tls/cache.c
  */
diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index db8d5712212..05387a6ceef 100644
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -296,12 +296,18 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 	int		ctx_options = 0;
 	void		*app_data_index;
 
-	SSL_BIND_MEMORY(ctx = SSL_CTX_new(SSLv23_method())); /* which is really "all known SSL / TLS methods".  Idiots. */
+	SSL_BIND_OBJ_MEMORY(ctx = SSL_CTX_new(SSLv23_method())); /* which is really "all known SSL / TLS methods".  Idiots. */
 	if (!ctx) {
 		tls_log_error(NULL, "Failed creating TLS context");
 		return NULL;
 	}
 
+	/*
+	 *	Bind any other memory to the ctx to fix
+	 *	leaks on exit.
+	 */
+	SSL_BIND_MEMORY_BEGIN(ctx);
+
 	/*
 	 *	Save the config on the context so that callbacks which
 	 *	only get SSL_CTX* e.g. session persistence, can get it
@@ -321,6 +327,7 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 		if (conf->psk_query && !*conf->psk_query) {
 			ERROR("Invalid PSK Configuration: psk_query cannot be empty");
 		error:
+			SSL_BIND_MEMORY_END;
 			SSL_CTX_free(ctx);
 			return NULL;
 		}
@@ -803,11 +810,6 @@ post_ca:
 		SSL_free(ssl);
 	}
 
-	/*
-	 *	Setup session caching
-	 */
-	tls_cache_init(ctx, conf->session_cache_server ? true : false, conf->session_cache_lifetime);
-
 	/*
 	 *	Load dh params
 	 */
@@ -818,6 +820,16 @@ post_ca:
 		if (ctx_dh_params_load(ctx, dh_file) < 0) goto error;
 	}
 
+	/*
+	 *	We're done configuring the ctx.
+	 */
+	SSL_BIND_MEMORY_END;
+
+	/*
+	 *	Setup session caching
+	 */
+	tls_cache_init(ctx, conf->session_cache_server ? true : false, conf->session_cache_lifetime);
+
 	return ctx;
 }
 #endif