search

wolfSSL / wolfssl

The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. wolfSSL supports up to TLS 1.3 and DTLS 1.3!
https://www.wolfssl.com
GNU General Public License v2.0
2.22k stars 798 forks source link

20240626-EvictSessionFromCache-ticketNonce-data-leak #7687

Closed douzzer closed 1 week ago

douzzer commented 1 week ago

src/ssl_sess.c: in EvictSessionFromCache(), free session->ticketNonce.data if it was dynamically allocated. fixes memory leak via wolfSSL_Cleanup().

for history see 56d6087749 and 1106e5ff0e.

detected by wolfssl-multi-test.sh ... all-noasm-valgrind-unittest

tested with

LD_LIBRARY_PATH=./src/.libs saferun valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all --show-reachable=yes --leak-resolution=high --track-fds=yes --track-origins=yes --fullpath-after= --error-exitcode=10 ./tests/.libs/unit.test

also tested with wolfssl-multi-test.sh ... super-quick-check