From: William Lallemand <wlallemand@irq6.net>
Date: Sun, 27 Sep 2026 15:18:08 +0000 (+0000)
Subject: BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in ssl_sock_free_srv_ctx()
X-Git-Tag: v3.5-dev8~110
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=250e6ff1577c8a7329ee0d274d44bfffe179ab58;p=haproxy.git

BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in ssl_sock_free_srv_ctx()

The ssl-default-server-* keywords (curves, sigalgs, client_sigalgs)
allocate memory via strdup() that was never freed when servers are
destroyed. This causes a memory leak per server instance.

Add ha_free() calls guarded by the same OpenSSL API version checks
matching the allocation guards in cfgparse-ssl.c.

This change should be backported to all supported branches.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index c216b70cc..701287a2a 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -5965,6 +5965,15 @@ void ssl_sock_free_srv_ctx(struct server *srv)
 	srv->ssl_ctx.sni = NULL;
 #endif
 	ha_free(&srv->ssl_ctx.ciphers);
+#if defined(SSL_CTX_set1_curves_list)
+	ha_free(&srv->ssl_ctx.curves);
+#endif
+#if defined(SSL_CTX_set1_sigalgs_list)
+	ha_free(&srv->ssl_ctx.sigalgs);
+#endif
+#if defined(SSL_CTX_set1_client_sigalgs_list)
+	ha_free(&srv->ssl_ctx.client_sigalgs);
+#endif
 #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
 	ha_free(&srv->ssl_ctx.ciphersuites);
 #endif