(trafficserver) branch master updated: Fix memory leaks in SSL subsystem (#13026)

[bcall]

This is an automated email from the ASF dual-hosted git repository.

bcall pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new 1c9753039c Fix memory leaks in SSL subsystem (#13026)
1c9753039c is described below

commit 1c9753039c46e83c9e380c9c0146abdfbf3c42f4
Author: Bryan Call <bc...@apache.org>
AuthorDate: Mon Apr 13 13:35:24 2026 -0700

    Fix memory leaks in SSL subsystem (#13026)
    
    * Fix SSLOriginSessionCache destructor -- drain all queued
      SSLOriginSession nodes before the map is destroyed. The
      destructor was previously empty.
    * Allocate origin session cache once instead of delete/new on
      reload -- concurrent TLS handshakes hold bare pointers to
      the global. Let entries age out naturally.
    * Free ssl_ocsp_user_agent before overwriting on config reload.
    * Clear BIO_FLAGS_MEM_RDONLY before BIO_free so internal
      BUF_MEM structures are properly released.
---
 src/iocore/net/SSLConfig.cc       | 8 +++++++-
 src/iocore/net/SSLSessionCache.cc | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/iocore/net/SSLConfig.cc b/src/iocore/net/SSLConfig.cc
index 31362b39a9..c6b5f42232 100644
--- a/src/iocore/net/SSLConfig.cc
+++ b/src/iocore/net/SSLConfig.cc
@@ -460,7 +460,7 @@ SSLConfigParams::initialize()
   SSLConfigParams::origin_session_cache      = ssl_origin_session_cache;
   SSLConfigParams::origin_session_cache_size = ssl_origin_session_cache_size;
 
-  if (ssl_origin_session_cache == 1 && ssl_origin_session_cache_size > 0) {
+  if (ssl_origin_session_cache == 1 && ssl_origin_session_cache_size > 0 && 
origin_sess_cache == nullptr) {
     origin_sess_cache = new SSLOriginSessionCache();
   }
 
@@ -479,6 +479,7 @@ SSLConfigParams::initialize()
     set_paths_helper(ssl_ocsp_response_path, nullptr, 
&ssl_ocsp_response_path_only, nullptr);
   }
   if (auto 
rec_str{RecGetRecordStringAlloc("proxy.config.http.request_via_str")}; rec_str) 
{
+    ats_free(ssl_ocsp_user_agent);
     ssl_ocsp_user_agent = ats_stringdup(rec_str);
   }
 
@@ -868,6 +869,11 @@ SSLTicketParams::cleanup()
 void
 cleanup_bio(BIO *&biop)
 {
+  // BIO_new_mem_buf sets BIO_FLAGS_MEM_RDONLY which prevents BIO_free from
+  // cleaning up internal BUF_MEM structures. Clear this flag so BIO_free
+  // properly releases them. BIO_NOCLOSE ensures the external data buffer
+  // (owned by the caller's std::string) is not freed.
+  BIO_clear_flags(biop, BIO_FLAGS_MEM_RDONLY);
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wunused-value"
   BIO_set_close(biop, BIO_NOCLOSE);
diff --git a/src/iocore/net/SSLSessionCache.cc 
b/src/iocore/net/SSLSessionCache.cc
index 9f6c52fa94..2a68f26868 100644
--- a/src/iocore/net/SSLSessionCache.cc
+++ b/src/iocore/net/SSLSessionCache.cc
@@ -43,7 +43,13 @@ SSLSessDeleter(SSL_SESSION *_p)
 
 SSLOriginSessionCache::SSLOriginSessionCache() {}
 
-SSLOriginSessionCache::~SSLOriginSessionCache() {}
+SSLOriginSessionCache::~SSLOriginSessionCache()
+{
+  while (auto *node = orig_sess_que.pop()) {
+    delete node;
+  }
+  orig_sess_map.clear();
+}
 
 void
 SSLOriginSessionCache::insert_session(const std::string &lookup_key, 
SSL_SESSION *sess, SSL *ssl)