From 250e6ff1577c8a7329ee0d274d44bfffe179ab58 Mon Sep 17 00:00:00 2001 From: William Lallemand Date: Sun, 27 Sep 2026 15:18:08 +0000 Subject: [PATCH] BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in ssl_sock_free_srv_ctx() The ssl-default-server-* keywords (curves, sigalgs, client_sigalgs) allocate memory via strdup() that was never freed when servers are destroyed. This causes a memory leak per server instance. Add ha_free() calls guarded by the same OpenSSL API version checks matching the allocation guards in cfgparse-ssl.c. This change should be backported to all supported branches. --- src/ssl_sock.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/ssl_sock.c b/src/ssl_sock.c index c216b70cc..701287a2a 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -5965,6 +5965,15 @@ void ssl_sock_free_srv_ctx(struct server *srv) srv->ssl_ctx.sni = NULL; #endif ha_free(&srv->ssl_ctx.ciphers); +#if defined(SSL_CTX_set1_curves_list) + ha_free(&srv->ssl_ctx.curves); +#endif +#if defined(SSL_CTX_set1_sigalgs_list) + ha_free(&srv->ssl_ctx.sigalgs); +#endif +#if defined(SSL_CTX_set1_client_sigalgs_list) + ha_free(&srv->ssl_ctx.client_sigalgs); +#endif #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES ha_free(&srv->ssl_ctx.ciphersuites); #endif -- 2.47.3