BUG/MINOR: ssl: Fix leak of X509_NAME in traces

When X509_NAME_oneline() is called without a buffer, it allocates one
which was never free'd in the SSL traces' code. Rather than free it, we
might as well use a trash to avoid an allocation.

This was introduced in 3.2 by commit 4a8fa28e3 ("MINOR: ssl: Add traces
around SSL_do_handshake call"). It must be backported to 3.2.

Reported-by: Claude (ANT-2026-4P18WC9H)

diff --git a/src/ssl_trace.c b/src/ssl_trace.c
index 96cb8a2a7443097f33ae6c3e501fb5b57e8795d2..c0f605d780e5326d0bfa821dfb06ecea79d1596f 100644 (file)
--- a/src/ssl_trace.c
+++ b/src/ssl_trace.c
@@ -141,9 +141,11 @@ static void ssl_trace(enum trace_level level, uint64_t mask, const struct trace_
 
                                if (crt) {
                                        __X509_NAME_CONST__ X509_NAME *name = X509_get_subject_name(crt);
-                                       if (name)
+                                       if (name) {
+                                               chunk_reset(&trash);
                                                chunk_appendf(&trace_buf, " subject=\"%s\"",
-                                                             X509_NAME_oneline(name, 0, 0));
+                                                             X509_NAME_oneline(name, b_orig(&trash), b_size(&trash)));
+                                       }
                                }
                        }
                }