Memory leak query during TLS handshake

[chiru1228]

Hello,

We are observing a memory leak during TLS handshake with OpenSSL version openssl 1.1.1k.
Has anyone else observed a similar pattern of leak?
Below is the call stack trace. which we get from our memory tracker. Please suggest if there are any fixes available in later versions.
Please provide your input to address the below indicated memory leak.

(realloc + 0x4)[ : ]
(CRYPTO_realloc + 0x7c)[ openssl\crypto\mem.c:246 ]
(ASN1_STRING_set + 0xe0)[ openssl\crypto\asn1\asn1_lib.c:295 ]
(asn1_ex_c2i + 0x410)[ openssl\crypto\asn1\tasn_dec.c:906 ]
(asn1_d2i_ex_primitive + 0x504)[ openssl\crypto\asn1\tasn_dec.c:780 ]
(asn1_item_embed_d2i + 0x1e8)[ openssl\crypto\asn1\tasn_dec.c:182 ]
(ASN1_item_ex_d2i + 0x48)[ openssl\crypto\asn1\tasn_dec.c:124 ]
(ASN1_item_d2i + 0x64)[ openssl\crypto\asn1\tasn_dec.c:114 ]
(X509V3_EXT_d2i + 0xa4)[ openssl\crypto\x509v3\v3_lib.c:142 ]
(X509V3_get_d2i + 0x1a8)[ openssl\crypto\x509v3\v3_lib.c:201 ]
(X509_get_ext_d2i + 0x28)[ openssl\crypto\x509\x509_ext.c:104 ]
(x509v3_cache_extensions + 0x80c)[ openssl\crypto\x509v3\v3_purp.c:511 ]
(x509_likely_issued + 0x54)[ openssl\crypto\x509v3\v3_purp.c:862 ]
(check_issued + 0x18)[ openssl\crypto\x509\x509_vfy.c:421 ]
(X509_STORE_CTX_get1_issuer + 0xd0)[ openssl\crypto\x509\x509_lu.c:694 ]
(get_issuer + 0x4c)[ openssl\crypto\x509\x509_vfy.c:3002 ]
(verify_chain + 0x24)[ openssl\crypto\x509\x509_vfy.c:230 ]
(X509_verify_cert + 0x2d4)[ openssl\crypto\x509\x509_vfy.c:372 ]
(ssl_verify_cert_chain + 0x2d4)[ openssl\ssl\ssl_cert.c:427 ]
(tls_process_server_certificate + 0x494)[ openssl\ssl\statem\statem_clnt.c:1897 ]
(ossl_statem_client_process_message + 0x130)[ openssl\ssl\statem\statem_clnt.c:1039 ]
(read_state_machine + 0x3e4)[ openssl\ssl\statem\statem.c:636 ]
(state_machine + 0x570)[ openssl\ssl\statem\statem.c:434 ]
(ossl_statem_connect + 0x18)[ openssl\ssl\statem\statem.c:250 ]
(SSL_do_handshake + 0x118)[ openssl\ssl\ssl_lib.c:3710 ]
(SSL_connect + 0x30)[ openssl\ssl\ssl_lib.c:1684 ]

Thanks,
Chiru

[t8m]

Unfortunately 1.1.1 version is supported only for premium support customers. Also the 1.1.1k version is not even the latest release that was public.

[chiru1228]

Thank you for your quick response. However, as upgrading is a considerable effort on our platform, please let us know if using the latest version 1.1.1w would resolve this.

[chiru1228]

I upgraded to the latest OpenSSL version 1.1.1w and still see the same leak pattern as OpenSSL 1.1.1K. Do you have any thoughts about this?

[t8m]

I would suspect this is an application bug. If this was a real memory leak bug in OpenSSL 1.1.1 we would seen such reports earlier. Or this is a very narrow corner case.