Back-patch 7.4-era fix for memory leak with SSL connections due to

missing X509_free() calls.  Per a request from a Red Hat customer;
seems silly for Red Hat to be shipping a patch that's not in upstream.

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 7065da068a12065af76a5f3bfe2d50315809016f..69c87842e5bd59ae3c2d8d01674bd8ee8b51e08b 100644 (file)
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -775,6 +775,9 @@ destroy_SSL(void)
 static int
 open_server_SSL(Port *port)
 {
+       Assert(!port->ssl);
+       Assert(!port->peer);
+
        if (!(port->ssl = SSL_new(SSL_context)) ||
                !my_SSL_set_fd(port->ssl, port->sock) ||
                SSL_accept(port->ssl) <= 0)
@@ -821,6 +824,12 @@ close_SSL(Port *port)
                SSL_free(port->ssl);
                port->ssl = NULL;
        }
+
+       if (port->peer)
+       {
+               X509_free(port->peer);
+               port->peer = NULL;
+       }
 }
 
 /*

diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index 5e017e3422534ed5e2556c8ceac022d8b347b5ea..ba6903373062d581576f1a8637c34c5b982a9aa9 100644 (file)
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -897,6 +897,12 @@ close_SSL(PGconn *conn)
                SSL_free(conn->ssl);
                conn->ssl = NULL;
        }
+
+       if (conn->peer)
+       {
+               X509_free(conn->peer);
+               conn->peer = NULL;
+       }
 }
 
 /*