Memory leak in SSLSocket.getpeercert()

[alex]

BPO	25569
Nosy	@pitrou, @giampaolo, @tiran, @benjaminp, @alex, @vadmium, @dstufft, @matrixise
Files	issue25569.patch issue25569-2.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2015-11-14.13:54:21.525>
created_at = <Date 2015-11-06.20:08:01.009>
labels = []
title = 'Memory leak in SSLSocket.getpeercert()'
updated_at = <Date 2015-11-14.13:54:21.523>
user = 'https://github.com/alex'

bugs.python.org fields:

activity = <Date 2015-11-14.13:54:21.523>
actor = 'alex'
assignee = 'none'
closed = True
closed_date = <Date 2015-11-14.13:54:21.525>
closer = 'alex'
components = []
creation = <Date 2015-11-06.20:08:01.009>
creator = 'alex'
dependencies = []
files = ['40963', '40976']
hgrepos = []
issue_num = 25569
keywords = ['patch']
message_count = 12.0
messages = ['254210', '254211', '254212', '254213', '254215', '254251', '254271', '254301', '254519', '254625', '254644', '254660']
nosy_count = 10.0
nosy_names = ['janssen', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'benjamin.peterson', 'alex', 'python-dev', 'martin.panter', 'dstufft', 'matrixise']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue25569'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6']

[alex]

Run the following code:

import socket
import ssl
import sys


def main():
    ctx = ssl.create_default_context()
    s = socket.create_connection(('www.bing.com', 443))
    s = ctx.wrap_socket(s, server_hostname='www.bing.com')
    while True:
        s.getpeercert()

        sys.stderr.write('.')
        sys.stderr.flush()


if __name__ == '__main__':
    main()

and observe memory usage, you'll see it increases by a MB/s or so.

[alex]

A probably source of the leak is here: https://github.com/python/cpython/blob/master/Modules/_ssl.c#L1073-L1076 dps is never freed. (This is with OpenSSL 0.9.8zg)

[matrixise]

Hi Alex,

not sure, but I think the right function to free the memory is AUTHORITY_INFO_ACCESS_free(dps)

I will provide a patch for a review asap

[alex]

I think you want sk_DIST_POINT_free actually.

[matrixise]

Maybe you are right, I didn't see that this function returns a pointer in function of the parameter. sorry.

Could you try with this patch, really sorry but my internet connection is really slow and I have a problem with the _ssl module on my laptop (problem with the compilation and the dependencies because I am on OSX).

Thank you

[alex]

Tests pass and the original script runs without a leak using this patch. It could probably be shorter if we converted from local returns to goto fail or something, but I don't really have an opinion.

[matrixise]

Hi alex,

Thank you for your feeback, I will propose an other patch with your remarks.

Stephane

[matrixise]

sorry for the delay.

here is a new version of my patch, if I can have feedback about this patch, I will really appreciate.

thank you

[python-dev]

New changeset 10c3646b2d59 by Benjamin Peterson in branch '2.7':
fix memory leak in _get_crl_dp (closes bpo-25569)
https://hg.python.org/cpython/rev/10c3646b2d59

New changeset aabe273b20ab by Benjamin Peterson in branch '3.4':
fix memory leak in _get_crl_dp (closes bpo-25569)
https://hg.python.org/cpython/rev/aabe273b20ab

New changeset 07a298572d93 by Benjamin Peterson in branch '3.5':
merge 3.5 (bpo-25569)
https://hg.python.org/cpython/rev/07a298572d93

New changeset fb55b1ab43fc by Benjamin Peterson in branch 'default':
merge 3.5 (bpo-25569)
https://hg.python.org/cpython/rev/fb55b1ab43fc

[vadmium]

Seems to have broken the SSL module. Looks like you typoed “dps” as “dsp” in some conditional code.

http://buildbot.python.org/all/builders/AMD64%20Snow%20Leop%203.4/builds/1326/steps/compile/logs/stdio

building '_ssl' extension
gcc -fno-strict-aliasing -g -O0 -Wall -Wstrict-prototypes -Werror=declaration-after-statement -I./Include -I. -IInclude -I/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Include -I/Users/buildbot/buildarea/3.4.murray-snowleopard/build -c /Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c -o build/temp.macosx-10.6-x86_64-3.4-pydebug/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.o
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c: In function ‘_get_crl_dp’:
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:1084: error: ‘dsp’ undeclared (first use in this function)
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:1084: error: (Each undeclared identifier is reported only once
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:1084: error: for each function it appears in.)
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c: In function ‘_setup_ssl_threads’:
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:3828: warning: comparison is always false due to limited range of data type

[python-dev]

New changeset 3b9fb8ebf44f by Benjamin Peterson in branch '2.7':
fix build with older openssl (bpo-25569)
https://hg.python.org/cpython/rev/3b9fb8ebf44f

New changeset f13a75544b6f by Benjamin Peterson in branch '3.4':
fix build with older openssl (bpo-25569)
https://hg.python.org/cpython/rev/f13a75544b6f

New changeset 83ea7e75605a by Benjamin Peterson in branch '3.5':
merge 3.4 (bpo-25569)
https://hg.python.org/cpython/rev/83ea7e75605a

New changeset 8ac09e46ca45 by Benjamin Peterson in branch 'default':
merge 3.5 (bpo-25569)
https://hg.python.org/cpython/rev/8ac09e46ca45

[alex]

fixed