Fenrir 15782: wolfSSL Static blocks are ref counted and freed by last ref by aidankeefe2022 · Pull Request #11899 · wolfSSL/wolfssl

aidankeefe2022 · 2026-10-26T20:36:27Z

Description

With WOLFSSL_STATIC_MEMORY, each SSL gets its own heap hint, and wolfSSL_free() used to release it. Some objects allocated from that hint can outlive the SSL: a session from wolfSSL_get1_session(), the server's peer cert stored in the session, or an X509 from wolfSSL_get_peer_certificate(). After wolfSSL_free(), freeing or using these objects touched a heap hint that had already been freed.

The per-SSL heap hint now has a reference count (wolfSSL_Ref). The SSL holds one reference, and so does every block allocated from the hint.
Each allocated block stores its owning hint in wc_Memory.next, a field that sits unused while the block is allocated. wolfSSL_Free() drops that reference, so the hint goes back to the pool when its last block is freed.
wolfSSL_free() drops the SSL's reference through wc_HeapHint_Release().
Fixed IO buffers (WOLFMEM_IO_POOL_FIXED) belong to the SSL and hold no reference. IO pool buffers do hold one.
In realloc, the new block takes its reference before the old block drops its own, so a block that is the hint's last holder can still be reallocated. IO buffers are resized in place and keep their owner.
CTX, user and global hints are not reference counted.

Testing

The static heap session, ticket and peer cert chain tests now check the hint's ref count as the SSL, sessions and X509s are freed. A new case has an X509 as the last holder.
New test_wolfSSL_static_heap_io_refs (IO pool and fixed IO) and test_wolfSSL_static_heap_realloc_refs tests.
The tests check that curAlloc returns to its baseline (skipped with WOLFSSL_STATIC_MEMORY_LEAN).
Fixed test_wolfSSL_CTX_add_session_ext without WOLFSSL_TICKET_HAVE_ID. A TLS 1.2 ticket session has no session ID, so it can't be added to the cache, and the remove callback isn't called on resumption.

Copilot

🟡 Changes recommended

The new regression tests need configuration fixes for builds without PEM parsing or TLS 1.2 client authentication.

2 open issues

What changed in this PR

This PR fixes session memory ownership so retained sessions do not depend on a connection’s freed static-memory heap hint.

Changes:

Create sessions using the context heap during initialization and reset.
Use the session heap for tickets, ticket nonces, and retained peer certificates.
Add regression tests for session retention, duplication, resumption, and cleanup.

File	Description
`tests/api.c`	Adds static-memory session lifetime and cleanup tests.
`src/ssl.c`	Uses the context heap when `wolfSSL_clear()` replaces a session.
`src/ssl_api_cert.c`	Allocates peer-chain certificates from the session heap.
`src/internal.c`	Corrects session creation and ticket-related heap usage.

_{Review effort: Balanced}

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11899

Scan targets checked: wolfssl-src, wolfssl-bugs
Coverage: 2 of 4 in-scope changed file(s) opened by the reviewer; not opened: src/internal.c, tests/api.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

github-actions · 2026-10-26T20:51:12Z

retest this please

github-actions · 2026-10-26T20:54:48Z

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

FLASH: rodata +100 B, text +144 B (+0.1%, 282,496 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

julek-wolfssl

This is not a maintainable solution. Caller sites should not have knowledge about which hint to use. I would prefer to store a reference counter in WOLFSSL_HEAP_HINT and let the allocator figure out when it can be released. Attached is a detailed description of what I envision.

pr11899-heap-hint-refcount.md

With WOLFSSL_STATIC_MEMORY, each SSL gets its own heap hint, and wolfSSL_free() releases it. Some objects allocated from that hint can live longer than the SSL: a session kept with wolfSSL_get1_session(), the server's peer cert stored in the session, or an X509 returned by wolfSSL_get_peer_certificate(). After wolfSSL_free(), these objects point at a hint that no longer exists. Update the static heap session, ticket and peer cert chain tests to check the hint's refCount as the SSL, sessions and X509s are freed. Add a case where an X509 is the last holder. Check that curAlloc returns to its baseline (except with WOLFSSL_STATIC_MEMORY_LEAN). Fix test_wolfSSL_CTX_add_session_ext without WOLFSSL_TICKET_HAVE_ID: a TLS 1.2 ticket session has no session ID, so it can't be added to the cache, and the remove callback isn't called on resumption.

julek-wolfssl · 2026-10-27T22:13:50Z

        wc_Memory*  inBuf;
        byte        haFlag; /* flag used for checking handshake count */
    #endif
+        word32      refCount; /* SSL ref + other refs */


This needs to be wolfSSL_Ref and use the accompanying functions for using this type.

julek-wolfssl · 2026-10-27T22:17:24Z

+            #ifdef WOLFSSL_STATIC_MEMORY
+                void* heap = x509->heap;
+            #endif
                FreeX509(x509);
                XFREE(x509, x509->heap, DYNAMIC_TYPE_X509);
+            #ifdef WOLFSSL_STATIC_MEMORY
+                /* after the XFREE: it may free the hint x509 came from */
+                wc_HeapHint_Unref(heap);
+            #endif
            }


My idea was that FreeSSL_StaticMemory would mark the heap as ready for release and then the last XFREE call would de-allocate the heap hint. This way wc_HeapHint_Unref doesn't need to be called by any caller and everything happens under the hood.

Ohh yeah that is better! Fixing now

aidankeefe2022 · 2026-10-28T19:02:50Z

retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11899

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 5 of 6 in-scope changed file(s) opened by the reviewer; not opened: tests/api.c

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

Copilot

🟡 Changes recommended

The API tests still call XREALLOC when WOLFSSL_STATIC_MEMORY and WOLFSSL_NO_REALLOC are enabled, causing link failure because wolfSSL_Realloc() is compiled out.

1 open issue

Guard realloc tests when WOLFSSL_NO_REALLOC is enabled · New

2 resolved since last review

_{Review effort: Balanced}

Static blocks now keep a ref count and only free when all holders are done holding.

aidankeefe2022 · 2026-10-28T22:37:44Z

added some guards to tests this just passed CI before that change assigning to wolfSSL_Bot

aidankeefe2022 self-assigned this Oct 26, 2026

aidankeefe2022 requested review from wolfSSL-Fenrir-bot and a balanced review from Copilot October 26, 2026 20:36

Copilot started reviewing on behalf of aidankeefe2022 October 26, 2026 20:36

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

Comment thread tests/api.c Outdated

Comment thread tests/api.c Outdated

wolfSSL-Fenrir-bot reviewed Oct 26, 2026

View reviewed changes

aidankeefe2022 force-pushed the ssl-sess-fenrir branch from 329a888 to e508cc1 Compare October 26, 2026 20:50

aidankeefe2022 marked this pull request as ready for review October 26, 2026 20:51

philljj requested review from Frauschi and julek-wolfssl October 27, 2026 00:00

danielinux changed the title ~~Fenrir 15782 (HIGH): Allocate session memory from the CTX heap, not the SSL heap~~ Fenrir 15782: Allocate session memory from the CTX heap, not the SSL heap Oct 27, 2026

julek-wolfssl requested changes Oct 27, 2026

View reviewed changes

aidankeefe2022 force-pushed the ssl-sess-fenrir branch from e508cc1 to 09fb499 Compare October 27, 2026 21:53

julek-wolfssl requested changes Oct 27, 2026

View reviewed changes

aidankeefe2022 changed the title ~~Fenrir 15782: Allocate session memory from the CTX heap, not the SSL heap~~ Fenrir 15782: Static blocks are ref counted and freed by last ref Oct 28, 2026

aidankeefe2022 changed the title ~~Fenrir 15782: Static blocks are ref counted and freed by last ref~~ Fenrir 15782: wolfSSL Static blocks are ref counted and freed by last ref Oct 28, 2026

aidankeefe2022 assigned wolfSSL-Bot and unassigned aidankeefe2022 Oct 28, 2026

aidankeefe2022 requested review from julek-wolfssl and wolfSSL-Fenrir-bot October 28, 2026 21:24

wolfSSL-Fenrir-bot requested changes Oct 28, 2026

View reviewed changes

Comment thread tests/api.c Outdated

aidankeefe2022 assigned aidankeefe2022 and unassigned wolfSSL-Bot Oct 28, 2026

aidankeefe2022 requested a balanced review from Copilot October 28, 2026 21:44

Copilot started reviewing on behalf of aidankeefe2022 October 28, 2026 21:45

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

Comment thread tests/api.c

HEAP_HINT has refcount in free and alloc

a02fbcd

Static blocks now keep a ref count and only free when all holders are done holding.

aidankeefe2022 force-pushed the ssl-sess-fenrir branch from fce7f12 to a02fbcd Compare October 28, 2026 22:30

aidankeefe2022 assigned wolfSSL-Bot and unassigned aidankeefe2022 Oct 28, 2026

Conversation

aidankeefe2022 commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11899

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

Uh oh!

julek-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

julek-wolfssl Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

julek-wolfssl Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 commented Oct 28, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11899

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

aidankeefe2022 commented Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

aidankeefe2022 commented Oct 26, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading