Search the Community

The patch below suggests fixes for 7 memory leaks in OverbyteIcsWSocket.pas. They surfaced after the OverbyteIcsSslWebServ.dpr sample project was linked against YuOpenSSL. A total of > 10k memory allocations reported not freed, adding up to > 500k bytes of leaked memory. The leaks were easy to spot because YuOpenSSL does not use the OpenSSL DLLs but compiles all OpenSSL code into the application binary. As a side effect, YuOpenSSL uses the Delphi memory manager and by default allows memory trackers to see OpenSSL memory allocations. Otherwise this does normally not happen when the OpenSSL DLLs employ their own memory management. The leaks then sum up in the DLLs' memory space, and out of sight of Delphi's memory trackers. For anyone who would like to test their ICS applications for memory leaks with YuOpenSSL, here is the link: https://www.yunqa.de/delphi/products/openssl/index Index: OverbyteIcsWSocket.pas =================================================================== --- OverbyteIcsWSocket.pas (revision 1492) +++ OverbyteIcsWSocket.pas (working copy) @@ -13933,7 +13933,8 @@ for I := 0 to Result - 1 do begin P := f_OPENSSL_sk_value(CertStack, I); if Assigned(P) then { V8.64 sanity test } - Add(f_X509_dup(PX509(P))); + // Add(f_X509_dup(PX509(P))); // ralfjunker fix memory leak. + Add(PX509(P)); // ralfjunker fix memory leak. end; end; @@ -14866,7 +14867,8 @@ OneErr := String(LastOpenSslErrMsg(FALSE)); OneErr := 'Error Cert ' + IntToStr(tot) + ' - ' + OneErr; end; - end; + // end; ralfjunker fix memory leak. + end else f_BIO_free(MemBio); // ralfjunker fix memory leak. // ignore private keys and other stuff if OneErr <> '' then begin @@ -17369,7 +17371,8 @@ procedure TX509Base.FreeAndNilX509Inters; { V8.41 } begin if Assigned(FX509Inters) then begin - f_OPENSSL_sk_free(FX509Inters); + // f_OPENSSL_sk_free(FX509Inters); // ralfjunker fix memory leak. + f_OPENSSL_sk_pop_free(FX509Inters, @f_X509_free); // ralfjunker fix memory leak. FX509Inters := nil; end; end; @@ -18334,7 +18337,10 @@ // pending, search stack for server certificate, might not be first { first in stack is server certificate } - SetX509(PX509(f_OPENSSL_sk_delete(MyStack, 0))); + // SetX509(PX509(f_OPENSSL_sk_delete(MyStack, 0))); // ralfjunker fix memory leak. + x := PX509(f_OPENSSL_sk_delete(MyStack, 0)); // ralfjunker fix memory leak. + SetX509(x); // ralfjunker fix memory leak. + f_X509_free(x); // ralfjunker fix memory leak. { remaineder are intermediates } if (TotInfo > 1) and (IncludeInters > croNo) then begin @@ -19394,7 +19400,8 @@ begin result := '' ; if not Assigned(X509) then Exit; - pubkey := f_X509_get_pubkey(X509); + // pubkey := f_X509_get_pubkey(X509); // ralfjunker fix memory leak. + pubkey := f_X509_get0_pubkey(X509); // ralfjunker fix memory leak. Result := GetKeyDesc(pubkey); end; @@ -19500,17 +19507,27 @@ {* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *} procedure TX509Base.LoadIntersFromPemFile(const FileName: String); { V8.41 } +var // ralfjunker fix memory leak. + x: PStack; // ralfjunker fix memory leak. begin InitializeSsl; - SetX509Inters(IcsSslLoadStackFromInfoFile(FileName, emCert)); + // SetX509Inters(IcsSslLoadStackFromInfoFile(FileName, emCert)); // ralfjunker fix memory leak. + x := IcsSslLoadStackFromInfoFile(FileName, emCert); // ralfjunker fix memory leak. + SetX509Inters(x); // ralfjunker fix memory leak. + f_OPENSSL_sk_free(x); // ralfjunker fix memory leak. end; {* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *} procedure TX509Base.LoadIntersFromString(const Value: String); { V8.41 } +var // ralfjunker fix memory leak. + x: PStack; // ralfjunker fix memory leak. begin InitializeSsl; - SetX509Inters(IcsSslLoadStackFromInfoString(Value, emCert)); + // SetX509Inters(IcsSslLoadStackFromInfoString(Value, emCert)); // ralfjunker fix memory leak. + x := IcsSslLoadStackFromInfoString(Value, emCert); // ralfjunker fix memory leak. + SetX509Inters(x); // ralfjunker fix memory leak. + f_OPENSSL_sk_free(x); // ralfjunker fix memory leak. end;

In OverbyteIcsWSocket.pas, PunyServerName is always filled with 8-bit data, even if it is a 16-bit UnicodeString on Unicode Delphis. This happens in OverbyteIcsWSocket.pas line 15916 (SVN 1469): Move(DataExt[5], Ws.FCliHelloData.PunyServerName[1], Slen); The line above works well with non Unicode Delphis, but copies incorrect data in Unicode enabled Delphis. Cause is the declaration of PunyServerName (line 3488): TClientHelloData = record ServerName: String; PunyServerName: String; // <-- Problem here. ... Later on, this results in incorrect conversion to ServerName. See that the OverbyteIcsSslWebServ demo outputs garbled SNI and Server Name instead of localhost: HTTPS Server is waiting for connections https://localhost/demo.html HTTP Server is waiting for connections http://localhost/demo.html [10:17:36 127.0.0.1] SNI "潬慣桬獯t Client Hello: Server Name: 潬慣桬獯t [10:18:15 127.0.0.1] SNI "潬慣桬獯t Client Hello: Server Name: 潬慣桬獯t A quick remedy is to declare PunyServerName as AnsiString and work around the warning "OverbyteIcsWSocket.pas(15968): W1057 Implicit string cast from 'AnsiString' to 'string'", possibly be adding a typecast. TClientHelloData = record ServerName: String; PunyServerName: AnsiString; // <-- 8-bit string, even in Unicode Delphis. ... Ralf

OverbyteIcsWSocket.pas has at least one small memory leak. In line 17009 (SVN 1464), an X509Obj is duplicated before its is added to the list. However, TX509Base.Create() duplicates the duplication once more before TX509List.Add() stores it to the list. The first duplicated object is never freed, resulting in the leak. This is the line in question: CertList.Add(f_X509_dup(f_X509_OBJECT_get0_X509 (MyX509Obj))); The fix is to remove f_X509_dup(), so the line looks like this: CertList.Add(f_X509_OBJECT_get0_X509 (MyX509Obj)); Code analysis suggests that a similar leak is present in line 15012, but I have not been able to trigger this code running one of the Sample projects: Cert.AddToInters(f_X509_dup(f_X509_OBJECT_get0_X509 (MyX509Obj))); Ralf