From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Mon, 17 Aug 2026 16:05:52 +0000 (+0200)
Subject: BUG/MINOR: ssl: Fix leak of X509_NAME in traces
X-Git-Tag: v3.5-dev5~26
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=6306b2b38459f3dcec30dcd6880ff024a226677b;p=haproxy.git

BUG/MINOR: ssl: Fix leak of X509_NAME in traces

When X509_NAME_oneline() is called without a buffer, it allocates one
which was never free'd in the SSL traces' code. Rather than free it, we
might as well use a trash to avoid an allocation.

This was introduced in 3.2 by commit 4a8fa28e3 ("MINOR: ssl: Add traces
around SSL_do_handshake call"). It must be backported to 3.2.

Reported-by: Claude (ANT-2026-4P18WC9H)
---

diff --git a/src/ssl_trace.c b/src/ssl_trace.c
index 96cb8a2a7..c0f605d78 100644
--- a/src/ssl_trace.c
+++ b/src/ssl_trace.c
@@ -141,9 +141,11 @@ static void ssl_trace(enum trace_level level, uint64_t mask, const struct trace_
 
 				if (crt) {
 					__X509_NAME_CONST__ X509_NAME *name = X509_get_subject_name(crt);
-					if (name)
+					if (name) {
+						chunk_reset(&trash);
 						chunk_appendf(&trace_buf, " subject=\"%s\"",
-							      X509_NAME_oneline(name, 0, 0));
+							      X509_NAME_oneline(name, b_orig(&trash), b_size(&trash)));
+					}
 				}
 			}
 		}