cURL / Mailing Lists / curl-library / Single Mail

curl-library

Re: Proposed fix for OpenSSL memory leaks.

From: Mischa Salle <msalle_at_nikhef.nl>
Date: Thu, 10 May 2012 11:37:50 +0200

Hi Jonathon,

How you should do thinks depends a bit on your code, but in any case you
should certainly *not* call curl_global_cleanup in a separate thread (as
the name already implies).
The problem with OpenSSL is that it uses global data which can only be
safely cleaned at the end of an executable (i.e. never from a dynamic
library as other parts might still use the same data). However, OpenSSL
would be abstracted away from the point of view of that binary, as it
only sees curl. That's why curl provides the curl_global_cleanup call.
Actually any decent dynamic library should provide such a global cleanup
function, which should call the global cleanup functions of its
dependencies. The real problem emerges if you use both curl+openssl
*and* openssl directly, then you can just hope that the cleanup
functions put the pointers to NULL to prevent double free()'s...
Concerning the init: in principle the curl_global_init is called
automatically by the curl_easy_init if you don't do it explicitly (if
I'm not mistaken).

    Best regards,
    Mischa

On Wed, May 09, 2012 at 07:14:47PM -0700, JonathonS wrote:
> Hi guys,
>
> So I found out that my program was leaking memory because I was
> invoking curl_global_init, curl_global_cleanup, curl_easy_init and
> curl_easy_cleanup on separate threads. This was causing a leak in SSL
> (when curl_ssl_init was called).
>
> To confirm my theory that initialization/uninitialization functions
> must be invoked on the same thread, I looked through the libcurl docs
> but I couldn't find any mention of this. I did however find some
> mention of thread-safety.
>
> Can someone point me to the docs where it describes the behavior
> mentioned above please? thanks!
>
> J
>
> On Mon, Apr 16, 2012 at 11:03 AM, Daniel Stenberg <daniel_at_haxx.se> wrote:
> > On Mon, 16 Apr 2012, JonathonS wrote:
> >
> >> Just out of curiosity, has this issue been resolved? :)
> >
> >
> > No. As you can see nobody ever responded to my critique of the patch and
> > nobody provided any updates to it, and I'm backlogged half way to the moon
> > so I've not been able to do it myself yet.
> >
> >
> >> I am currently statically linking on Windows to libcurl version 7.24.0 and
> >> statically linking to OpenSSL 1.0.0g.  My debugger is reporting a lot of
> >> memory leaks which looks like it could be the same issue.
> >
> >
> > Looks like or actually is?
> >
> > We get that "it leaks memory" report very often and it very rarely turns out
> > to be true.
> >
> > --
> >
> >  / daniel.haxx.se
> > -------------------------------------------------------------------
> > List admin: http://cool.haxx.se/list/listinfo/curl-library
> > Etiquette:  http://curl.haxx.se/mail/etiquette.html
>
> -------------------------------------------------------------------
> List admin: http://cool.haxx.se/list/listinfo/curl-library
> Etiquette: http://curl.haxx.se/mail/etiquette.html

-- 
Nikhef                      Room  H155
Science Park 105            Tel.  +31-20-592 5102
1098 XG Amsterdam           Fax   +31-20-592 5155
The Netherlands             Email msalle_at_nikhef.nl
  __ .. ... _._. .... ._  ... ._ ._.. ._.. .._..

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html

  • application/x-pkcs7-signature attachment: smime.p7s
Received on 2012-05-10