From 3b42cf7c2805ab97ae5fe8d6cd023cfbdbfb7f25 Mon Sep 17 00:00:00 2001 From: Tim Perry Date: Thu, 8 Oct 2026 13:16:52 +0200 Subject: [PATCH] tls: fix OpenSSL compression leak that breaks tests under ASAN This is not impactful in any way - it's a fixed leak of the openssl record compression descriptors, about 24 bytes leaked total, once per process. Not meaningful. It is annoying if you want to run with ASAN & leak detection though, since it's an unambiguous leak we trigger every time crypto is used. Signed-off-by: Tim Perry --- src/crypto/crypto_util.cc | 5 ++++- test/parallel/test-tls-certificate-compression.js | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc index a99b4f10af24..fd53de77d4e8 100644 --- a/src/crypto/crypto_util.cc +++ b/src/crypto/crypto_util.cc @@ -553,7 +553,10 @@ void InitCryptoOnce() { // Turn off compression. Saves memory and protects against CRIME attacks. // No-op with OPENSSL_NO_COMP builds of OpenSSL. - sk_SSL_COMP_zero(SSL_COMP_get_compression_methods()); + STACK_OF(SSL_COMP)* comp_methods = SSL_COMP_get_compression_methods(); + while (sk_SSL_COMP_num(comp_methods) > 0) { + OPENSSL_free(sk_SSL_COMP_pop(comp_methods)); + } #ifndef OPENSSL_NO_ENGINE EnginePointer::initEnginesOnce(); diff --git a/test/parallel/test-tls-certificate-compression.js b/test/parallel/test-tls-certificate-compression.js index b543ae4143c8..5dc4190c8faf 100644 --- a/test/parallel/test-tls-certificate-compression.js +++ b/test/parallel/test-tls-certificate-compression.js @@ -76,8 +76,8 @@ const fixtureCert = fixtures.readKey('agent1-cert.pem'); // Test: certificate compression must not enable record-level compression. // // RFC 8879 certificate compression is unrelated to TLS record compression -// (the CRIME attack vector). The latter is disabled by Node at startup via -// sk_SSL_COMP_zero, and by modern OpenSSL defaults as well. To confirm, we +// (the CRIME attack vector). The latter is disabled by Node at startup in +// InitCryptoOnce(), and by modern OpenSSL defaults as well. To confirm, we // Verify a ClientHello sent by Node only advertises null record compression. (async () => { const { promise: clientHelloReceived, resolve: onClientHello } =