From 369d1c90453be23270a30229cbf4f731e4080407 Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Tue, 3 Mar 2026 09:00:18 +0100 Subject: lib: Fix missing cleanup in authentication path When auth_verify_crt fails (e.g., missing root CA), crypt_get_pubkey_crt has already allocated pk but only crt was freed. Adds a crypt_cleanup() function to wrap OpenSSL_cleanup(), as OpenSSL lazily initializes a global decoder/provider registry the first time PEM_read_bio or OSSL_DECODER_CTX_new_for_pkey is called, and this leaves some memory owned by OpenSSL that triggers the leak sanitizer. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- include/ouroboros/crypt.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/ouroboros/crypt.h b/include/ouroboros/crypt.h index 806d39ab..c0b001d1 100644 --- a/include/ouroboros/crypt.h +++ b/include/ouroboros/crypt.h @@ -358,6 +358,8 @@ int crypt_check_crt_name(void * crt, int crypt_get_crt_name(void * crt, char * name); +void crypt_cleanup(void); + /* Secure memory allocation for sensitive data (keys, secrets) */ int crypt_secure_malloc_init(size_t max); -- cgit v1.2.3