OpenSSL ASN1_item_ex_d2i 内存泄漏

Question

我有一个带有 openSSL 库的探针，我有内存泄漏：

==9904== 
==9904== HEAP SUMMARY:
==9904==     in use at exit: 163,350 bytes in 2,867 blocks
==9904==   total heap usage: 5,104 allocs, 2,237 frees, 1,162,949 bytes allocated
==9904== 
==9904== 4,808 (184 direct, 4,624 indirect) bytes in 1 blocks are definitely lost in loss record 279 of 284
==9904==    at 0x4C28BED: malloc (vg_replace_malloc.c:263)
==9904==    by 0x5106DFF: CRYPTO_malloc (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==9904==    by 0x51A27EB: ??? (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==9904==    by 0x51A517F: ASN1_item_ex_d2i (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==9904==    by 0x51A5BF3: ASN1_item_d2i (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==9904==    by 0x4E4789C: ??? (in /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0)
==9904==    by 0x4E48ED7: ??? (in /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0)
==9904==    by 0x4026BD: main (main.c:68)
==9904== 
==9904== LEAK SUMMARY:
==9904==    definitely lost: 184 bytes in 1 blocks
==9904==    indirectly lost: 4,624 bytes in 103 blocks
==9904==      possibly lost: 0 bytes in 0 blocks
==9904==    still reachable: 158,542 bytes in 2,763 blocks
==9904==         suppressed: 0 bytes in 0 blocks
==9904== Reachable blocks (those to which a pointer was found) are not shown.
==9904== To see them, rerun with: --leak-check=full --show-reachable=yes
==9904== 
==9904== For counts of detected and suppressed errors, rerun with: -v
==9904== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 8 from 6)

你知道这个问题吗？你能帮帮我吗？

罗曼 支持

Answer 1

您必须使用调试选项（即 ./config -d ...）重新编译 libssl.so.1.0.0 库才能跟踪内存泄漏源

Answer 2

我刚刚调查了一份类似的泄漏报告，结果发现在调用 SSL_get_peer_certificate() 之后缺少对 X509_free() 的调用。

OpenSSL 文档的相关部分是：

SSL_get_peer_certificate() 返回指向对等方提供的 X509 证书的指针。如果对等方没有提供证书，则返回 NULL。

...

X509 对象的引用计数加一，这样在释放包含对等证书的会话时它就不会被销毁。 X509 对象必须使用 X509_free() 显式释放。