HEAP_HINT has refcount in free and alloc

Static blocks now keep a ref count and only free when all holders are
done holding.

Author: aidankeefe2022

src/internal.c

@@ -5930,13 +5930,6 @@ void InitX509(WOLFSSL_X509* x509, int dynamicFlag, void* heap)
         (void)ret;
     }
 #endif
-#ifdef WOLFSSL_STATIC_MEMORY
-    /* A dynamic X509 can outlive the SSL whose heap hint it uses; dropped in
-     * ExternalFreeX509() */
-    if (dynamicFlag) {
-        wc_HeapHint_Ref(heap);
-    }
-#endif
 }
 
 
@@ -8893,6 +8886,7 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
     if (ctx->heap != NULL) {
         WOLFSSL_HEAP_HINT* ssl_hint;
         WOLFSSL_HEAP_HINT* ctx_hint;
+        int ret = 0;
 
         /* avoid dereferencing a test value */
     #ifdef WOLFSSL_HEAP_TEST
@@ -8911,13 +8905,24 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
         ctx_hint = ((WOLFSSL_HEAP_HINT*)(ctx->heap));
 
         ssl_hint->memory = ctx_hint->memory;
-        ssl_hint->refCount = 1; /* the SSL's own reference */
+        /* the SSL's ref; each allocated block holds another */
+        wolfSSL_RefInit(&ssl_hint->refCount, &ret);
+    #ifdef WOLFSSL_REFCNT_ERROR_RETURN
+        if (ret != 0) {
+            WOLFSSL_MSG("Error setting up heap hint reference mutex");
+            XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
+            ssl->heap = NULL;
+            return ret;
+        }
+    #endif
+        (void)ret;
         ssl_hint->sslOwned = 1;
     #ifndef WOLFSSL_STATIC_MEMORY_LEAN
     #ifndef SINGLE_THREADED
         /* lock and check IO count / handshake count */
         if (wc_LockMutex(&(ctx_hint->memory->memory_mutex)) != 0) {
             WOLFSSL_MSG("Bad memory_mutex lock");
+            wolfSSL_RefFree(&ssl_hint->refCount);
             XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
             ssl->heap = NULL; /* free and set to NULL for IO counter */
             WOLFSSL_ERROR_VERBOSE(BAD_MUTEX_E);
@@ -8930,6 +8935,7 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
         #ifndef SINGLE_THREADED
             wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
         #endif
+            wolfSSL_RefFree(&ssl_hint->refCount);
             XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
             ssl->heap = NULL; /* free and set to NULL for IO counter */
             return MEMORY_E;
@@ -8941,6 +8947,7 @@ static int InitSSL_StaticMemory(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
         #ifndef SINGLE_THREADED
             wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
         #endif
+            wolfSSL_RefFree(&ssl_hint->refCount);
             XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
             ssl->heap = NULL; /* free and set to NULL for IO counter */
             return MEMORY_E;
@@ -10303,8 +10310,7 @@ static void FreeSSL_StaticMemory(WOLFSSL* ssl)
             WOLFSSL_MSG("Bad memory_mutex lock");
         }
     #endif
-        /* detach stats under the lock: sessions and X509s holding a reference
-         * may still allocate through this hint from other threads */
+        /* detach under the lock: live blocks may still use the hint */
         if (ctx_heap->flag & WOLFMEM_TRACK_STATS) {
             stats = ssl_hint->stats;
             ssl_hint->stats = NULL;
@@ -10328,8 +10334,8 @@ static void FreeSSL_StaticMemory(WOLFSSL* ssl)
          * ssl->heap, which the SSL's reference still keeps alive here */
         XFREE(stats, heap, DYNAMIC_TYPE_SSL);
     #endif
-        /* drop the SSL's reference; other holders may keep the hint alive */
-        wc_HeapHint_Unref(ssl->heap);
+        /* drop the SSL's ref; the last block's free may free the hint */
+        wc_HeapHint_Release(ssl->heap);
         ssl->heap = NULL;
     #ifdef WOLFSSL_HEAP_TEST
     }

src/ssl_sess.c

@@ -4042,9 +4042,6 @@ WOLFSSL_SESSION* wolfSSL_NewSession(void* heap)
 #endif
         ret->type = WOLFSSL_SESSION_TYPE_HEAP;
         ret->heap = heap;
-#ifdef WOLFSSL_STATIC_MEMORY
-        wc_HeapHint_Ref(heap);
-#endif
 #ifdef WOLFSSL_CHECK_MEM_ZERO
         wc_MemZero_Add("SESSION master secret", ret->masterSecret, SECRET_LEN);
         wc_MemZero_Add("SESSION id", ret->sessionID, ID_LEN);
@@ -4494,15 +4491,8 @@ void wolfSSL_FreeSession(WOLFSSL_CTX* ctx, WOLFSSL_SESSION* session)
     ForceZero(session->sessionID, ID_LEN);
 
     if (session->type == WOLFSSL_SESSION_TYPE_HEAP) {
-    #ifdef WOLFSSL_STATIC_MEMORY
-        void* heap = session->heap;
-    #endif
         /* // NOLINTNEXTLINE(clang-analyzer-unix.Malloc) */
         XFREE(session, session->heap, DYNAMIC_TYPE_SESSION);
-    #ifdef WOLFSSL_STATIC_MEMORY
-        /* after the XFREE: it may free the hint the session came from */
-        wc_HeapHint_Unref(heap);
-    #endif
     }
 }
 

src/x509.c

@@ -4281,15 +4281,8 @@ static void ExternalFreeX509(WOLFSSL_X509* x509)
             if (doFree)
         #endif /* OPENSSL_EXTRA_X509_SMALL || OPENSSL_EXTRA */
             {
-            #ifdef WOLFSSL_STATIC_MEMORY
-                void* heap = x509->heap;
-            #endif
                 FreeX509(x509);
                 XFREE(x509, x509->heap, DYNAMIC_TYPE_X509);
-            #ifdef WOLFSSL_STATIC_MEMORY
-                /* after the XFREE: it may free the hint x509 came from */
-                wc_HeapHint_Unref(heap);
-            #endif
             }
         }
         else {