Skip to content

Fenrir 15782: wolfSSL Static blocks are ref counted and freed by last ref #11899

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidankeefe2022 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fenrir 15782: wolfSSL Static blocks are ref counted and freed by last ref #11899

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
09fb499
Reference count per-SSL static memory heap hints
aidankeefe2022 Oct 26, 2026
a02fbcd
HEAP_HINT has refcount in free and alloc
aidankeefe2022 Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 39 additions & 20 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8886,6 +8886,7 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
if (ctx->heap != NULL) {
WOLFSSL_HEAP_HINT* ssl_hint;
WOLFSSL_HEAP_HINT* ctx_hint;
int ret = 0;

/* avoid dereferencing a test value */
#ifdef WOLFSSL_HEAP_TEST
Expand All @@ -8904,11 +8905,24 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
ctx_hint = ((WOLFSSL_HEAP_HINT*)(ctx->heap));

ssl_hint->memory = ctx_hint->memory;
/* the SSL's ref; each allocated block holds another */
wolfSSL_RefInit(&ssl_hint->refCount, &ret);
#ifdef WOLFSSL_REFCNT_ERROR_RETURN
if (ret != 0) {
WOLFSSL_MSG("Error setting up heap hint reference mutex");
XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
ssl->heap = NULL;
return ret;
}
#endif
(void)ret;
ssl_hint->sslOwned = 1;
#ifndef WOLFSSL_STATIC_MEMORY_LEAN
#ifndef SINGLE_THREADED
/* lock and check IO count / handshake count */
if (wc_LockMutex(&(ctx_hint->memory->memory_mutex)) != 0) {
WOLFSSL_MSG("Bad memory_mutex lock");
wolfSSL_RefFree(&ssl_hint->refCount);
XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
ssl->heap = NULL; /* free and set to NULL for IO counter */
WOLFSSL_ERROR_VERBOSE(BAD_MUTEX_E);
Expand All @@ -8921,6 +8935,7 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
#ifndef SINGLE_THREADED
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
#endif
wolfSSL_RefFree(&ssl_hint->refCount);
XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
ssl->heap = NULL; /* free and set to NULL for IO counter */
return MEMORY_E;
Expand All @@ -8932,6 +8947,7 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
#ifndef SINGLE_THREADED
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
#endif
wolfSSL_RefFree(&ssl_hint->refCount);
XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
ssl->heap = NULL; /* free and set to NULL for IO counter */
return MEMORY_E;
Expand Down Expand Up @@ -10283,18 +10299,22 @@ static void FreeSSL_StaticMemory(WOLFSSL* ssl)
/* avoid dereferencing a test value */
if (ssl->heap != (void*)WOLFSSL_HEAP_TEST) {
#endif
void* heap = ssl->ctx ? ssl->ctx->heap : ssl->heap;
#ifndef WOLFSSL_STATIC_MEMORY_LEAN
WOLFSSL_HEAP_HINT* ssl_hint = (WOLFSSL_HEAP_HINT*)ssl->heap;
WOLFSSL_HEAP* ctx_heap;
WOLFSSL_MEM_CONN_STATS* stats;
WOLFSSL_HEAP* ctx_heap = ssl_hint->memory;
void* heap = ssl->ctx ? ssl->ctx->heap : ssl->heap;
WOLFSSL_MEM_CONN_STATS* stats = NULL;

ctx_heap = ssl_hint->memory;
#ifndef SINGLE_THREADED
if (wc_LockMutex(&(ctx_heap->memory_mutex)) != 0) {
WOLFSSL_MSG("Bad memory_mutex lock");
}
#endif
/* detach under the lock: live blocks may still use the hint */
if (ctx_heap->flag & WOLFMEM_TRACK_STATS) {
stats = ssl_hint->stats;
ssl_hint->stats = NULL;
}
ctx_heap->curIO--;
if (FreeFixedIO(ctx_heap, &(ssl_hint->outBuf)) != 1) {
WOLFSSL_MSG("Error freeing fixed output buffer");
Expand All @@ -10310,16 +10330,13 @@ static void FreeSSL_StaticMemory(WOLFSSL* ssl)
#ifndef SINGLE_THREADED
wc_UnLockMutex(&(ctx_heap->memory_mutex));
#endif

/* check if tracking stats */
if (ctx_heap->flag & WOLFMEM_TRACK_STATS) {
/* with ssl->ctx NULL, heap is ssl->heap and XFREE updates stats */
stats = ssl_hint->stats;
ssl_hint->stats = NULL;
XFREE(stats, heap, DYNAMIC_TYPE_SSL);
}
#endif /* !WOLFSSL_STATIC_MEMORY_LEAN */
XFREE(ssl->heap, heap, DYNAMIC_TYPE_SSL);
/* unlocked, XFREE takes memory_mutex; with ssl->ctx NULL, heap is
* ssl->heap, which the SSL's reference still keeps alive here */
XFREE(stats, heap, DYNAMIC_TYPE_SSL);
#endif
/* drop the SSL's ref; the last block's free may free the hint */
wc_HeapHint_Release(ssl->heap);
ssl->heap = NULL;
#ifdef WOLFSSL_HEAP_TEST
}
#endif
Expand Down Expand Up @@ -20695,7 +20712,7 @@ int DoFinished(WOLFSSL* ssl, const byte* input, word32* inOutIdx, word32 size,
ssl->msgsReceived.got_session_ticket) {
ForceZero(ssl->session->ticket, ssl->session->ticketLen);
if (ssl->session->ticketLenAlloc > 0) {
XFREE(ssl->session->ticket, ssl->heap,
XFREE(ssl->session->ticket, ssl->session->heap,
DYNAMIC_TYPE_SESSION_TICK);
ssl->session->ticket = ssl->session->staticTicket;
ssl->session->ticketLenAlloc = 0;
Expand Down Expand Up @@ -39944,14 +39961,15 @@ int SetTicket(WOLFSSL* ssl, const byte* ticket, word32 length)

/* Free old dynamic ticket if we already had one */
if (ssl->session->ticketLenAlloc > 0) {
XFREE(ssl->session->ticket, ssl->heap, DYNAMIC_TYPE_SESSION_TICK);
XFREE(ssl->session->ticket, ssl->session->heap,
DYNAMIC_TYPE_SESSION_TICK);
ssl->session->ticket = ssl->session->staticTicket;
ssl->session->ticketLenAlloc = 0;
}

if (length > sizeof(ssl->session->staticTicket)) {
byte* sessionTicket =
(byte*)XMALLOC(length, ssl->heap, DYNAMIC_TYPE_SESSION_TICK);
byte* sessionTicket = (byte*)XMALLOC(length, ssl->session->heap,
DYNAMIC_TYPE_SESSION_TICK);
if (sessionTicket == NULL)
return MEMORY_E;
ssl->session->ticket = sessionTicket;
Expand Down Expand Up @@ -44428,7 +44446,8 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)

if (ssl->session->ticket != ssl->session->staticTicket) {
/* Always use the static ticket buffer */
XFREE(ssl->session->ticket, NULL, DYNAMIC_TYPE_SESSION_TICK);
XFREE(ssl->session->ticket, ssl->session->heap,
DYNAMIC_TYPE_SESSION_TICK);
ssl->session->ticket = ssl->session->staticTicket;
ssl->session->ticketLenAlloc = 0;
}
Expand Down Expand Up @@ -45069,7 +45088,7 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
(!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3)))
if (ssl->session->ticketNonce.data
!= ssl->session->ticketNonce.dataStatic) {
XFREE(ssl->session->ticketNonce.data, ssl->heap,
XFREE(ssl->session->ticketNonce.data, ssl->session->heap,
DYNAMIC_TYPE_SESSION_TICK);
ssl->session->ticketNonce.data =
ssl->session->ticketNonce.dataStatic;
Expand Down
2 changes: 1 addition & 1 deletion src/ssl_sess.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4031,7 +4031,7 @@ WOLFSSL_SESSION* wolfSSL_NewSession(void* heap)
#ifdef WOLFSSL_REFCNT_ERROR_RETURN
if (err != 0) {
WOLFSSL_MSG("Error setting up session reference mutex");
XFREE(ret, ret->heap, DYNAMIC_TYPE_SESSION);
XFREE(ret, heap, DYNAMIC_TYPE_SESSION);
return NULL;
}
#else
Expand Down
Loading
Loading