Uh oh!
There was an error while loading. Please reload this page.
Update to openssl-3.5.8 - #12
Open
chethan-64 wants to merge 189 commits into
Open
Conversation
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> MergeDate: Tue Jun 9 11:54:39 2026 Release: yes
…e validating signature-based protection of CMP messages Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> MergeDate: Wed Jun 10 06:38:59 2026 (Merged from openssl#28986) (cherry picked from commit 0a6b666)
…utput on failure validating CMP messages Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> MergeDate: Wed Jun 10 06:39:00 2026 (Merged from openssl#28986) (cherry picked from commit b6eb715)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Wed Jun 10 07:15:38 2026 (Merged from openssl#31267) (cherry picked from commit 6e3627d)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Wed Jun 10 07:15:39 2026 (Merged from openssl#31267) (cherry picked from commit 58ebe68)
Reviewed-by: Daniel Kubec <kubec@openssl.foundation> Reviewed-by: Neil Horman <nhorman@openssl.org> MergeDate: Wed Jun 10 11:13:28 2026 (Merged from openssl#31352)
Commit a21f77d added explicit null assignments after EVP_KEYMGMT_free() calls at the err:, legacy:, and success exit paths in kem.c, asymcipher.c and signature.c. The identical exit paths in evp_keyexch_init() (crypto/evp/exchange.c) were not updated at the same time, leaving exchange.c as the only outlier in the family without these null assignments. This patch brings exchange.c into consistency with its sibling files by adding exchange = NULL and tmp_keymgmt = NULL after each free at the exit paths, matching the established pattern from a21f77d. No functional change intended. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Wed Jun 10 11:21:26 2026 (Merged from openssl#31394)
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> MergeDate: Wed Jun 10 11:28:41 2026 (Merged from openssl#31333)
I am doing this because I have need to add information that really does belong here, and the current stuff is less documentation than more or less some hand waving about how it works without any details So to summarize the changes: 1) This documents the current way that X509_verify_cert goes about building and verifying a chain, identifying the relevant flags that can affect how this happens today, and cross references the correct page to find the rest of the exhaustive list of verification flags and what they do. 2) This documents the verification callback and how it can be used to affect the verification outcome, This includes warning potential users of the callback of what returning values from it means, the common ways to end up unintentionaly doing things you did not expect with the callback, and that it depends upon internals and should not be relied upon. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> MergeDate: Wed Jun 10 11:33:13 2026 (Merged from openssl#31314) (cherry picked from commit b2a133e)
Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Wed Jun 10 12:46:55 2026 (Merged from openssl#31424)
RFC 5280 section 5.1.1.2 requires the signatureAlgorithm in the outer CertificateList wrapper to be identical to the signature field inside the signed TBSCertList. def_crl_verify() did not enforce this, unlike X509_verify() and X509_ACERT_verify() which both carry an X509_ALGOR_cmp guard. Add the same guard to def_crl_verify(). A mismatch raises X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH. No known attack results from the missing check; this is a conformance and hardening fix only. Add a regression test: a CRL with a valid RSA-SHA256 signature over a TBSCertList whose inner signatureAlgorithm claims ecdsaWithSHA256 is now rejected. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Thu Jun 11 08:51:03 2026 (Merged from openssl#31213)
Reviewed-by: Alicja Kario <hkario@redhat.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Thu Jun 11 08:57:14 2026 (Merged from openssl#31378)
Fixes c2ef9e1 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Thu Jun 11 10:30:02 2026 (Merged from openssl#31453) (cherry picked from commit d6ecc30)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 11 16:06:41 2026 (Merged from openssl#31390) (cherry picked from commit 6c90156)
Fixes a1d1988 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> MergeDate: Fri Jun 12 06:34:54 2026 (Merged from openssl#31475) (cherry picked from commit 00fddc9)
There is no PROV_R_INVALID_CIPHER on 3.6 use PROV_R_NOT_SUPPORTED instead. Fixes 73807b3 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> MergeDate: Fri Jun 12 06:34:15 2026 (Merged from openssl#31474) (cherry picked from commit 0217baf)
GitHub no longer supports Visual Studio 2022 on windows-2025 image, switch to VS 2026. Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Mon Jun 15 07:23:17 2026 (Merged from openssl#31497) (cherry picked from commit 164c156)
The test for client_hello and new_pending connection should be using its own dedicated SSL context. The thing is we should not be arming (and testing) those callbacks for every listener the RADIX test framework creates. This changeset moves the test from test/radix/quic_ops.c to test/radix/quic_tests.c. The test uses check_ctx_cbks RADIX script now. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Mon Jun 15 07:29:02 2026 (Merged from openssl#31421) (cherry picked from commit 461b688)
False result of a TEST_xxx() call should always indicate erroneous condition. Fix such calls. Also fix some calls which treated TEST_xxx() result as non-boolean. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Mon Jun 15 07:38:52 2026 (Merged from openssl#31457) (cherry picked from commit 7c765bb)
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Mon Jun 15 08:16:26 2026 (Merged from openssl#31505) (cherry picked from commit 5f88502)
Fixes: c7d5ea2 "Prepare to detect index changes in OCSP responder." Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Mon Jun 15 14:29:23 2026 (Merged from openssl#24981) (cherry picked from commit e4e5c05)
… session with polling This backports openssl#31111 Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> MergeDate: Wed Jun 17 07:38:42 2026 (Merged from openssl#31456) (cherry picked from commit f8f588c)
get_crl_score() is used when selecting a complete/base CRL. Its delta CRL rejection was chained after the extended CRL and IDP reason handling, so it could be skipped when extended CRL support was disabled, or when an IDP onlySomeReasons branch was taken. As a result, a CRL with a Delta CRL Indicator could be scored as a complete/base CRL candidate. Since a delta CRL contains only changes relative to a base CRL, this could cause a previously revoked certificate to be accepted as valid when only the delta CRL is presented to the verifier. Reject CRLs with base_crl_number unconditionally in get_crl_score() before IDP reason filtering. Delta CRLs are still considered by get_delta_sk() after a complete CRL is selected and check_delta_base() confirms compatibility. Add verify recipe coverage for a delta CRL being rejected as a complete CRL, and for a delta CRL with IssuingDistributionPoint.onlySomeReasons being rejected under -extended_crl. Reported-by: jujerpig (GitHub issue openssl#31040) Fixesopenssl#31040 Reviewed-by: Bob Beck <beck@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Wed Jun 17 08:53:02 2026 (Merged from openssl#31044) (cherry picked from commit 5a3723e)
Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> MergeDate: Wed Jun 17 16:22:20 2026 (Merged from openssl#31468) (cherry picked from commit 6ecdedb)
Add client-side validation to check if session ticket lifetime hints exceeds 7 days in TLS1.3 connections and caps it to the maximum value of 7 days(604800 seconds). Modified `CHANGES.md` with the description of updated change. Resolves: openssl#30808 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:25:33 2026 (Merged from openssl#31174) (cherry picked from commit 5a85e41)
The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from: 2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 2025-08-07T03:22:20.3655796Z ClickHouse#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211 2025-08-07T03:22:20.3656291Z ClickHouse#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231 2025-08-07T03:22:20.3657040Z ClickHouse#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353 2025-08-07T03:22:20.3657656Z ClickHouse#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666 2025-08-07T03:22:20.3658289Z ClickHouse#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843 2025-08-07T03:22:20.3658914Z ClickHouse#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490 2025-08-07T03:22:20.3659486Z ClickHouse#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191 2025-08-07T03:22:20.3660183Z ClickHouse#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958 2025-08-07T03:22:20.3660871Z ClickHouse#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56 2025-08-07T03:22:20.3661539Z ClickHouse#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125 2025-08-07T03:22:20.3662161Z ClickHouse#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342 2025-08-07T03:22:20.3662664Z ClickHouse#12 0x5584f0cda9e5 in main test/testutil/main.c:31 2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f) 2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f) 2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534) It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded. fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful. Fixes: openssl#31375 Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org> (cherry picked from commit 7f780be) Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:38:33 2026 (Merged from openssl#31442)
check_flood_stats read the path challenge/response counters immediately after the client's write returned, but the flood is delivered over a real socket and processed by the connection's assist thread asynchronously. Spin until the counters reach their expected values, the same way check_rejected already does, instead of failing on the first observation. Observed failure: https://github.com/openssl/openssl/actions/runs/27669771673/job/81831310551?pr=31538 Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> MergeDate: Thu Jun 18 13:07:27 2026 (Merged from openssl#31561) (cherry picked from commit 75f5996)
The pkcs11-provider was disabled due to fixed issues in PQC sigalgs. This re-enables it and update provider to the latest version to also fix the TLS test has been failing due to changes in kryoptic introduced in latchset/kryoptic#436 . This was a bug in pkcs11-provider that was fixed in openssl-projects/pkcs11-provider#722 . Reviewed-by: Matt Caswell <matt@openssl.foundation> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> MergeDate: Thu Jun 18 13:20:31 2026 (Merged from openssl#31556)
…ed() Store in_flight flag in a local variable for later use, as apkt->on_acked() may free apkt. Fixes: 427a02a "QUIC ACKM: Don't record non-inflight packets in CC" Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> MergeDate: Sun Jun 21 13:55:08 2026 (Merged from openssl#31447) (cherry picked from commit 4d9e2a5)
Correct a number of typos found in the man pages: * doc/man3/SSL_CTX_set1_curves.pod: attenion -> attention * doc/man3/CMS_EncryptedData_decrypt.pod: decypted -> decrypted * doc/man3/X509_get_default_cert_file.pod: delimeter -> delimiter * doc/man3/SSL_CTX_set_msg_callback.pod: diagostic -> diagnostic * doc/man7/openssl-core_dispatch.h.pod: dipatch -> dispatch * doc/man3/BIO_s_datagram.pod: hecause -> because * doc/man3/ASN1_aux_cb.pod: auxiliarly -> auxiliary CLA: trivial Fixes: 3d9d1ce "Add documentation for newly added ASN1 functions" Fixes: 408622b "BIO_s_dgram: add documentation and hazard warnings" Fixes: e2f6960 "CMS: Export CMS_EnvelopedData and add CMS_EnvelopedData_decrypt()" Fixes: 85977e0 "Fix group tuple handling in DEFAULT expansion" Fixes: bfcf135 "Update the msg_callback documentation" Fixes: 606e042 "Add support for loading root CAs from Windows crypto API" Fixes: 329b2a2 "DOCS: add openssl-core_numbers.h(7)" Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> MergeDate: Sun Jun 21 22:50:14 2026 (Merged from openssl#31596) (cherry picked from commit 7a54766)
Servers or clients that configure only a private key in expectation of always negotiating use of RFC7250 raw public keys failed to handle the "signature_algorithms_cert" extension. The issue is now resolved and the RPK tests now check that key-only configurations are robust also when the extension is sent by the peer. Key-only configurations are quite uncommon. As a best practice, RPK-capable servers and clients pair their private key with a (possibly self-signed) certificate, enabling fallback to X.509 handshakes with non-RPK peers. Fixes CVE-2026-14457 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Merge-date: Mon Aug 24 12:49:30 2026
ossl_cmp_msg_check_update() converts an unexpected CMP response sender DN with X509_NAME_oneline() and passes that peer-controlled string directly as the format argument to ERR_raise_data(). Printable percent characters survive the DN conversion, so a sender such as CN=%s%n reaches vsnprintf() as active format syntax without matching varargs. Fixes: CVE-2026-63073 Original patch by: Filipe Casal of Trail of Bits in collaboration with OpenAI Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Igor Ustinov <igus@openssl.foundation> Merge-date: Mon Aug 24 13:02:10 2026
Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Igor Ustinov <igus@openssl.foundation> Merge-date: Mon Aug 24 13:02:11 2026
Assisted-by: Claude:claude-fable-5 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Merge-date: Mon Aug 24 14:42:04 2026
On its integrity-failure paths that primitive writes and cleanses up to inlen bytes of the output buffer. Size the buffer for that worst case so a failed unwrap cannot write past the allocation. Fixes CVE-2026-63072 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Merge-date: Mon Aug 24 14:42:05 2026
dtls_rlayer_buffer_record() buffers records that arrive early for the next epoch while a handshake is in progress. It did this by taking ownership of the entire live read buffer (sized for the largest possible record, ~16.7KB) and allocating a brand new one to carry on reading, regardless of how small the buffered record actually was. With the queue capped at 100 entries, a peer could send around 100 tiny bogus next-epoch records (~14 bytes each on the wire) and force around 1.7MB of heap allocation per connection. Instead, copy only the record's own on-wire bytes (header and ciphertext) into the queue entry, and leave the live read buffer untouched. Memory use is now proportional to what the peer actually sends. Fixes CVE-2026-54874 Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Merge-date: Mon Aug 24 15:38:54 2026
100 buffered next-epoch records is far more than a normal handshake ever needs. A peer that has already completed its side of the epoch transition may send more than one record under the new epoch before we catch up and bump our own receive epoch - for example, application data sent immediately once the peer considers the handshake done - but real-world bursts like that are still small. Now that each entry only costs as much memory as the record actually received, the limit mainly serves as a ceiling on worst-case per-connection memory use, so lower it to 16 to keep that ceiling smaller while still leaving ample headroom over legitimate usage. Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Merge-date: Mon Aug 24 15:38:55 2026
rl->processed_rcds and the functions that serviced it (dtls_copy_rlayer_record(), dtls_retrieve_rlayer_buffered_record()) were unreachable: nothing in the codebase ever inserted a record into that queue, so the only consumer of it - the check at the top of dtls_get_more_records() - always saw an empty queue. The real mechanism for handing buffered next-epoch records to the next epoch's record layer is the unrelated forwarding code in dtls_free(), which pushes the raw bytes from rl->unprocessed_rcds onto rl->next. Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Merge-date: Mon Aug 24 15:38:56 2026
port_default_packet_handler() may perform double free of qrx when channel creation fails. The port_default_packet_handler() transfers ownership of qrx to channel/connection via call to port_bind_channel(). The port_bind_channel() however may release the qrx when channel can not be bound. The error is then detected in port_default_packet_handler() which then agains releases qrx for the second time. The fix is to add a reference counter to QRX object so transfer of ownership between port_default_packet_handler() and QUIC_CHANNEL can be handled safely. Fixes CVE-2026-18798 Reviewed-by: Igor Ustinov <igus@openssl.foundation> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Merge-date: Mon Aug 24 15:48:03 2026
Complements: b0576dc "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:36:54 2026
…g period Move HollowByte change log record after records with assigned CVE numbers and severity ratings, add period at the end of the lead sentence, add a link to the PR in the comment. Complements: 4db90eb "Update CHANGES/NEWS to mention the HollowByte fix" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:36:55 2026
3.5.8 CHANGES.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * openssl#31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * openssl#31572 "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts" * openssl#31749 "Add documentation for OPENSSL_armcap" * openssl#32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * openssl#32416 "[3.5,3.4] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * openssl#32427 "Backport openssl#32256 openssl 4.0 to 3.0" 3.5.8 NEWS.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * openssl#32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * openssl#32416 "[3.5,3.4] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * openssl#32427 "Backport openssl#32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:36:56 2026
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> MergeDate: Tue Aug 25 11:54:37 2026 Release: yes
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> MergeDate: Tue Aug 25 11:56:39 2026 Release: yes
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> MergeDate: Tue Aug 25 11:56:40 2026 Release: yes
(cherry picked from commit ae2e075)
(cherry picked from commit 35f2869)
(cherry picked from commit a6387b8)
(cherry picked from commit a5c57bb)
----- E Exception: Sanitizer assert found for instance ================== E WARNING: ThreadSanitizer: data race (pid=1) E Write of size 8 at 0x7b2800025d30 by thread T2 (mutexes: write M0, write M1): E #0 free <null> (clickhouse+0x709a3e5) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#1 CRYPTO_free build_docker/./contrib/openssl/crypto/mem.c:282:5 (clickhouse+0x2015f8ea) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#2 EVP_PKEY_free build_docker/./contrib/openssl/crypto/evp/p_lib.c:1809:5 (clickhouse+0x2012a751) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#3 Poco::Crypto::EVPPKey::~EVPPKey() build_docker/./base/poco/Crypto/src/EVPPKey.cpp:121:17 (clickhouse+0x1d00ffa9) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#4 DB::CertificateReloader::Data::~Data() build_docker/./src/Server/CertificateReloader.h:71:12 (clickhouse+0x194fb42d) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#5 std::__1::default_delete<DB::CertificateReloader::Data const>::operator()[abi:v15000](DB::CertificateReloader::Data const*) const build_docker/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:48:5 (clickhouse+0x194fb42d) E ClickHouse#6 std::__1::__shared_ptr_pointer<DB::CertificateReloader::Data const*, std::__1::default_delete<DB::CertificateReloader::Data const>, std::__1::allocator<DB::CertificateReloader::Data const>>::__on_zero_shared() build_docker/./contrib/llvm-project/libcxx/include/__memory/shared_ptr.h:263:5 (clickhouse+0x194fb42d) E ClickHouse#7 std::__1::__shared_count::__release_shared[abi:v15000]() build_docker/./contrib/llvm-project/libcxx/include/__memory/shared_ptr.h:174:9 (clickhouse+0x194fade0) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#8 std::__1::__shared_weak_count::__release_shared[abi:v15000]() build_docker/./contrib/llvm-project/libcxx/include/__memory/shared_ptr.h:215:27 (clickhouse+0x194fade0) E ClickHouse#9 std::__1::shared_ptr<DB::CertificateReloader::Data const>::~shared_ptr[abi:v15000]() build_docker/./contrib/llvm-project/libcxx/include/__memory/shared_ptr.h:702:23 (clickhouse+0x194fade0) E ClickHouse#10 std::__1::shared_ptr<DB::CertificateReloader::Data const>::operator=[abi:v15000](std::__1::shared_ptr<DB::CertificateReloader::Data const>&&) build_docker/./contrib/llvm-project/libcxx/include/__memory/shared_ptr.h:723:9 (clickhouse+0x194fade0) E ClickHouse#11 MultiVersion<DB::CertificateReloader::Data>::set(std::__1::unique_ptr<DB::CertificateReloader::Data const, std::__1::default_delete<DB::CertificateReloader::Data const>>&&) build_docker/./src/Common/MultiVersion.h:76:25 (clickhouse+0x194fade0) E ClickHouse#12 DB::CertificateReloader::tryLoad(Poco::Util::AbstractConfiguration const&) build_docker/./src/Server/CertificateReloader.cpp:83:18 (clickhouse+0x194f94ca) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#13 DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6::operator()(Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool) const build_docker/./programs/server/Server.cpp:1546:45 (clickhouse+0xf384df7) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#14 decltype(std::declval<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6&>()(std::declval<Poco::AutoPtr<Poco::Util::AbstractConfiguration>>(), std::declval<bool>())) std::__1::__invoke[abi:v15000]<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6&, Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool>(DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6&, Poco::AutoPtr<Poco::Util::AbstractConfiguration>&&, bool&&) build_docker/./contrib/llvm-project/libcxx/include/__functional/invoke.h:394:23 (clickhouse+0xf3827a9) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#15 void std::__1::__invoke_void_return_wrapper<void, true>::__call<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6&, Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool>(DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6&, Poco::AutoPtr<Poco::Util::AbstractConfiguration>&&, bool&&) build_docker/./contrib/llvm-project/libcxx/include/__functional/invoke.h:479:9 (clickhouse+0xf3827a9) E openssl#16 std::__1::__function::__default_alloc_func<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6, void (Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool)>::operator()[abi:v15000](Poco::AutoPtr<Poco::Util::AbstractConfiguration>&&, bool&&) build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:235:12 (clickhouse+0xf3827a9) E openssl#17 void std::__1::__function::__policy_invoker<void (Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool)>::__call_impl<std::__1::__function::__default_alloc_func<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_6, void (Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool)>>(std::__1::__function::__policy_storage const*, Poco::AutoPtr<Poco::Util::AbstractConfiguration>&&, bool) build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:716:16 (clickhouse+0xf3827a9) E openssl#18 std::__1::__function::__policy_func<void (Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool)>::operator()[abi:v15000](Poco::AutoPtr<Poco::Util::AbstractConfiguration>&&, bool&&) const build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:848:16 (clickhouse+0x19fd2cbe) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#19 std::__1::function<void (Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool)>::operator()(Poco::AutoPtr<Poco::Util::AbstractConfiguration>, bool) const build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:1187:12 (clickhouse+0x19fd2cbe) E openssl#20 DB::ConfigReloader::reloadIfNewer(bool, bool, bool, bool) build_docker/./src/Common/Config/ConfigReloader.cpp:150:13 (clickhouse+0x19fd2cbe) E openssl#21 DB::ConfigReloader::reload() build_docker/./src/Common/Config/ConfigReloader.h:51:21 (clickhouse+0xf38767c) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#22 DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13::operator()() const build_docker/./programs/server/Server.cpp:1731:31 (clickhouse+0xf38767c) E openssl#23 decltype(std::declval<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13&>()()) std::__1::__invoke[abi:v15000]<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13&>(DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13&) build_docker/./contrib/llvm-project/libcxx/include/__functional/invoke.h:394:23 (clickhouse+0xf38767c) E openssl#24 void std::__1::__invoke_void_return_wrapper<void, true>::__call<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13&>(DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13&) build_docker/./contrib/llvm-project/libcxx/include/__functional/invoke.h:479:9 (clickhouse+0xf38767c) E openssl#25 std::__1::__function::__default_alloc_func<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13, void ()>::operator()[abi:v15000]() build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:235:12 (clickhouse+0xf38767c) E openssl#26 void std::__1::__function::__policy_invoker<void ()>::__call_impl<std::__1::__function::__default_alloc_func<DB::Server::main(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>> const&)::$_13, void ()>>(std::__1::__function::__policy_storage const*) build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:716:16 (clickhouse+0xf38767c) E openssl#27 std::__1::__function::__policy_func<void ()>::operator()[abi:v15000]() const build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:848:16 (clickhouse+0x16907aa0) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#28 std::__1::function<void ()>::operator()() const build_docker/./contrib/llvm-project/libcxx/include/__functional/function.h:1187:12 (clickhouse+0x16907aa0) E openssl#29 DB::Context::reloadConfig() const build_docker/./src/Interpreters/Context.cpp:4357:5 (clickhouse+0x16907aa0) E openssl#30 DB::InterpreterSystemQuery::execute() build_docker/./src/Interpreters/InterpreterSystemQuery.cpp:577:29 (clickhouse+0x17e78c19) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#31 DB::executeQueryImpl(char const*, char const*, std::__1::shared_ptr<DB::Context>, DB::QueryFlags, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) build_docker/./src/Interpreters/executeQuery.cpp:1195:40 (clickhouse+0x17e3e462) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#32 DB::executeQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context>, DB::QueryFlags, DB::QueryProcessingStage::Enum) build_docker/./src/Interpreters/executeQuery.cpp:1374:26 (clickhouse+0x17e39837) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#33 DB::TCPHandler::runImpl() build_docker/./src/Server/TCPHandler.cpp:518:54 (clickhouse+0x195cc651) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#34 DB::TCPHandler::run() build_docker/./src/Server/TCPHandler.cpp:2329:9 (clickhouse+0x195e8707) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#35 Poco::Net::TCPServerConnection::start() build_docker/./base/poco/Net/src/TCPServerConnection.cpp:43:3 (clickhouse+0x1d00d942) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#36 Poco::Net::TCPServerDispatcher::run() build_docker/./base/poco/Net/src/TCPServerDispatcher.cpp:115:20 (clickhouse+0x1d00e1b1) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#37 Poco::PooledThread::run() build_docker/./base/poco/Foundation/src/ThreadPool.cpp:188:14 (clickhouse+0x1d20f2e6) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#38 Poco::(anonymous namespace)::RunnableHolder::run() build_docker/./base/poco/Foundation/src/Thread.cpp:45:11 (clickhouse+0x1d20d5af) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#39 Poco::ThreadImpl::runnableEntry(void*) build_docker/./base/poco/Foundation/src/Thread_POSIX.cpp:335:27 (clickhouse+0x1d20ba69) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E E Previous atomic write of size 4 at 0x7b2800025d30 by thread T3 (mutexes: write M2): E #0 CRYPTO_DOWN_REF build_docker/./contrib/openssl/include/internal/refcount.h:51:12 (clickhouse+0x2012a6e6) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#1 EVP_PKEY_free build_docker/./contrib/openssl/crypto/evp/p_lib.c:1795:5 (clickhouse+0x2012a6e6) E ClickHouse#2 ssl_cert_clear_certs build_docker/./contrib/openssl/ssl/ssl_cert.c:246:9 (clickhouse+0x1ffafd37) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#3 ssl_cert_free build_docker/./contrib/openssl/ssl/ssl_cert.c:277:5 (clickhouse+0x1ffafd37) E ClickHouse#4 ossl_ssl_connection_free build_docker/./contrib/openssl/ssl/ssl_lib.c:1458:5 (clickhouse+0x1ffba6af) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#5 SSL_free build_docker/./contrib/openssl/ssl/ssl_lib.c:1417:9 (clickhouse+0x1ffb920e) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#6 Poco::Net::SecureSocketImpl::reset() build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:583:3 (clickhouse+0x1cfaac60) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#7 Poco::Net::SecureSocketImpl::~SecureSocketImpl() build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:80:3 (clickhouse+0x1cfaac60) E ClickHouse#8 Poco::Net::SecureStreamSocketImpl::~SecureStreamSocketImpl() build_docker/./base/poco/NetSSL_OpenSSL/src/SecureStreamSocketImpl.cpp:52:1 (clickhouse+0x1cfb15dd) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#9 Poco::Net::SecureStreamSocketImpl::~SecureStreamSocketImpl() build_docker/./base/poco/NetSSL_OpenSSL/src/SecureStreamSocketImpl.cpp:43:1 (clickhouse+0x1cfb15dd) E ClickHouse#10 Poco::RefCountedObject::release() const build_docker/./base/poco/Foundation/include/Poco/RefCountedObject.h:86:13 (clickhouse+0x1cffc81e) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E ClickHouse#11 Poco::Net::Socket::~Socket() build_docker/./base/poco/Net/src/Socket.cpp:68:10 (clickhouse+0x1cffc81e) E ClickHouse#12 Poco::Net::StreamSocket::~StreamSocket() build_docker/./base/poco/Net/src/StreamSocket.cpp:63:1 (clickhouse+0x1d009c39) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#13 Poco::Net::TCPConnectionNotification::~TCPConnectionNotification() build_docker/./base/poco/Net/src/TCPServerDispatcher.cpp:43:2 (clickhouse+0x1d00ef50) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#14 Poco::Net::TCPConnectionNotification::~TCPConnectionNotification() build_docker/./base/poco/Net/src/TCPServerDispatcher.cpp:42:2 (clickhouse+0x1d00ef50) E openssl#15 Poco::RefCountedObject::release() const build_docker/./base/poco/Foundation/include/Poco/RefCountedObject.h:86:13 (clickhouse+0x1d00e203) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#16 Poco::AutoPtr<Poco::Notification>::~AutoPtr() build_docker/./base/poco/Foundation/include/Poco/AutoPtr.h:91:19 (clickhouse+0x1d00e203) E openssl#17 Poco::Net::TCPServerDispatcher::run() build_docker/./base/poco/Net/src/TCPServerDispatcher.cpp:122:3 (clickhouse+0x1d00e203) E openssl#18 Poco::PooledThread::run() build_docker/./base/poco/Foundation/src/ThreadPool.cpp:188:14 (clickhouse+0x1d20f2e6) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#19 Poco::(anonymous namespace)::RunnableHolder::run() build_docker/./base/poco/Foundation/src/Thread.cpp:45:11 (clickhouse+0x1d20d5af) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) E openssl#20 Poco::ThreadImpl::runnableEntry(void*) build_docker/./base/poco/Foundation/src/Thread_POSIX.cpp:335:27 (clickhouse+0x1d20ba69) (BuildId: 706d92b17db171493f293d517643f726ee1b7b1e) (cherry picked from commit 5b50434)
During my testing (*), I got below stack about leaked memory. - at database startup, Azure is registered as an object storage (--> registerAzureObjectStorage) - this calls into Azure, then into curl, and then into OpenSSL - curl asks OpenSSL for a bunch of random numbers (--> function 'ossl_random' in curl's OpenSSL wrapper) - OpenSSL initializes the random number generator and stores it in some random number generator context object (--> *RAND_get0_public) - this object is registered via pthread_key_create and pthread_setspecific registered in TLS - if registerAzureObjectStorage was the only place which initializes the RNG, we could argue that the leaked memory does not matter anyways as it is released after shutdown - RAND_get0_public also registers a free handler (rand_delete_thread_state) that runs in TLS, so the memory is released also if registration is called from arbitrary other threads. In sum: this is a false positive. (*) https://github.com/ClickHouse/clickhouse-private/issues/10107#issuecomment-2161282313 ``` ================================================================= ==2757181==ERROR: LeakSanitizer: detected memory leaks Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x5672f4a48083 in malloc (/data/ch4/build_asan/programs/clickhouse+0xa2b7083) (BuildId: 4d868624feaa8b5598d9d0b327749c877bfb6cfd) ClickHouse#1 0x567321d05c7e in CRYPTO_malloc build_asan/./contrib/openssl/crypto/mem.c:202:11 ClickHouse#2 0x567321d05c7e in CRYPTO_zalloc build_asan/./contrib/openssl/crypto/mem.c:222:11 ClickHouse#3 0x567321d5f9cf in EVP_RAND_CTX_new build_asan/./contrib/openssl/crypto/evp/evp_rand.c:353:11 ClickHouse#4 0x567321d627db in rand_new_drbg build_asan/./contrib/openssl/crypto/rand/rand_lib.c:658:11 ClickHouse#5 0x567321d61e7b in RAND_get0_public build_asan/./contrib/openssl/crypto/rand/rand_lib.c:777:16 ClickHouse#6 0x567321d61d4f in RAND_bytes_ex build_asan/./contrib/openssl/crypto/rand/rand_lib.c:378:12 ClickHouse#7 0x56731cfe9267 in ossl_random openssl.c ClickHouse#8 0x56731cf534ae in Curl_rand (/data/ch4/build_asan/programs/clickhouse+0x327c24ae) (BuildId: 4d868624feaa8b5598d9d0b327749c877bfb6cfd) ClickHouse#9 0x56731cf757dc in Curl_socketpair (/data/ch4/build_asan/programs/clickhouse+0x327e47dc) (BuildId: 4d868624feaa8b5598d9d0b327749c877bfb6cfd) ClickHouse#10 0x56731cf40bfe in Curl_multi_handle (/data/ch4/build_asan/programs/clickhouse+0x327afbfe) (BuildId: 4d868624feaa8b5598d9d0b327749c877bfb6cfd) ClickHouse#11 0x56731cecb260 in curl_easy_perform (/data/ch4/build_asan/programs/clickhouse+0x3273a260) (BuildId: 4d868624feaa8b5598d9d0b327749c877bfb6cfd) ClickHouse#12 0x56731cd4a351 in Azure::Core::Http::CurlConnection::CurlConnection(Azure::Core::Http::Request&, Azure::Core::Http::CurlTransportOptions const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) build_asan/./contrib/azure/sdk/core/azure-core/src/http/curl/curl.cpp:2441:24 openssl#13 0x56731cd3176b in std::__1::__unique_if<Azure::Core::Http::CurlConnection>::__unique_single std::__1::make_unique[abi:v15000]<Azure::Core::Http::CurlConnection, Azure::Core::Http::Request&, Azure::Core::Http::CurlTransportOptions const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&>(Azure::Core::Http::Request&, Azure::Core::H ttp::CurlTransportOptions const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) build_asan/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:714:32 openssl#14 0x56731cd3176b in Azure::Core::Http::_detail::CurlConnectionPool::ExtractOrCreateCurlConnection(Azure::Core::Http::Request&, Azure::Core::Http::CurlTransportOptions const&, bool) build_asan/./contrib/azure/sdk/core/azure-core/src/http/curl/curl.cpp:2126:10 openssl#15 0x56731cd2f891 in Azure::Core::Http::CurlTransport::Send(Azure::Core::Http::Request&, Azure::Core::Context const&) build_asan/./contrib/azure/sdk/core/azure-core/src/http/curl/curl.cpp:351:48 openssl#16 0x56731cdd66db in Azure::Core::Http::Policies::_internal::TransportPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/core/azure-core/src/http/transport_policy.cpp:121:40 openssl#17 0x56731cd7c75b in Azure::Core::Http::Policies::_internal::LogPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/core/azure-core/src/http/log_policy.cpp:114:23 openssl#18 0x56731cdd0218 in Azure::Core::Http::Policies::_internal::RequestActivityPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/core/azure-core/src/http/request_activity_policy.cpp:110:23 openssl#19 0x56731cec5f18 in Azure::Storage::_internal::StoragePerRetryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/storage/azure-storage-common/src/storage_per_retry_policy.cpp:57:23 openssl#20 0x56731cec6d0b in Azure::Storage::_internal::StorageSwitchToSecondaryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/storage/azure-storage-common/src/storage_switch_to_secondary_policy.cpp:36:32 openssl#21 0x56731cdcd019 in Azure::Core::Http::Policies::_internal::RetryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/core/azure-core/src/http/retry_policy.cpp:146:34 openssl#22 0x56731cdd6e17 in Azure::Core::Http::Policies::_internal::TelemetryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/core/azure-core/src/http/telemetry_policy.cpp:23:21 openssl#23 0x56731cdb0ef5 in Azure::Core::Http::Policies::_internal::RequestIdPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/core/azure-core/inc/azure/core/http/policies/policy.hpp:453:27 openssl#24 0x56731cdfc53e in Azure::Storage::_internal::StorageServiceVersionPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/storage/azure-storage-common/inc/azure/storage/common/internal/storage_service_version_policy.hpp:34:25 openssl#25 0x56731ce4bff1 in Azure::Core::Http::_internal::HttpPipeline::Send(Azure::Core::Http::Request&, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/core/azure-core/inc/azure/core/internal/http/pipeline.hpp:230:29 openssl#26 0x56731ce4bff1 in Azure::Storage::Blobs::_detail::BlobContainerClient::Create(Azure::Core::Http::_internal::HttpPipeline&, Azure::Core::Url const&, Azure::Storage::Blobs::_detail::BlobContainerClient::CreateBlobContainerOptions const&, Azure::Core::Context const&) build_asan/./contrib/azure/sdk/storage/azure-storage-blobs/src/rest_client.cpp:1415:36 openssl#27 0x56731ce0bdd8 in Azure::Storage::Blobs::BlobContainerClient::Create(Azure::Storage::Blobs::CreateBlobContainerOptions const&, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/storage/azure-storage-blobs/src/blob_container_client.cpp:258:12 openssl#28 0x56731ce396dc in Azure::Storage::Blobs::BlobServiceClient::CreateBlobContainer(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Azure::Storage::Blobs::CreateBlobContainerOptions const&, Azure::Core::Context const&) const build_asan/./contrib/azure/sdk/storage/azure-storage-blobs/src/blob_service_client.cpp:264:41 openssl#29 0x56731018fcff in DB::getAzureBlobContainerClient(Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) build_asan/./src/Disks/ObjectStorages/AzureBlobStorage/AzureBlobStorageAuth.cpp:236:75 openssl#30 0x5673115a7352 in DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0::operator()(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool) const build_asan/./src/Disks/ObjectStorages/ObjectStorageFactory.cpp:315:13 openssl#31 0x5673115a7352 in decltype(std::declval<DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0&>()(std::declval<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&>(), std::declval<Poco::Util::AbstractConfiguration const&>(), std::declval<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&>(), std::declval<std::__1::shared_ptr<DB::Context const> const&>(), std::declval<bool>() )) std::__1::__invoke[abi:v15000]<DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool>(DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool&&) build_asan/./contrib/llvm-project/libcxx/include/__functional/invoke.h:394:23 openssl#32 0x5673115a7352 in std::__1::shared_ptr<DB::IObjectStorage> std::__1::__invoke_void_return_wrapper<std::__1::shared_ptr<DB::IObjectStorage>, false>::__call<DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_pt r<DB::Context const> const&, bool>(DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool&&) build_asan/./contrib/llvm-project/libcxx/include/__functional/invoke.h:470:16 openssl#33 0x5673115a7352 in std::__1::__function::__default_alloc_func<DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0, std::__1::shared_ptr<DB::IObjectStorage> (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool)>::operator()[abi:v 15000](std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool&&) build_asan/./contrib/llvm-project/libcxx/include/__functional/function.h:235:12 openssl#34 0x5673115a7352 in std::__1::shared_ptr<DB::IObjectStorage> std::__1::__function::__policy_invoker<std::__1::shared_ptr<DB::IObjectStorage> (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool)>::__call_impl<std::__1::__function::__default _alloc_func<DB::registerAzureObjectStorage(DB::ObjectStorageFactory&)::$_0, std::__1::shared_ptr<DB::IObjectStorage> (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool)>>(std::__1::__function::__policy_storage const*, std::__1::basic_string<cha r, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool) build_asan/./contrib/llvm-project/libcxx/include/__functional/function.h:716:16 openssl#35 0x5673115a0780 in std::__1::__function::__policy_func<std::__1::shared_ptr<DB::IObjectStorage> (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool)>::operator()[abi:v15000](std::__1::basic_string<char, std::__1::char_traits<char>, std::_ _1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool&&) const build_asan/./contrib/llvm-project/libcxx/include/__functional/function.h:848:16 openssl#36 0x5673115a0780 in std::__1::function<std::__1::shared_ptr<DB::IObjectStorage> (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool)>::operator()(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool) const build_asan/./contrib/llvm-project/libcxx/include/__functional/function.h:1187:12 openssl#37 0x5673115a0780 in DB::ObjectStorageFactory::create(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const> const&, bool) const build_asan/./src/Disks/ObjectStorages/ObjectStorageFactory.cpp:135:12 openssl#38 0x56731159ef45 in DB::registerDiskObjectStorage(DB::DiskFactory&, bool)::$_0::operator()(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const>, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1: :shared_ptr<DB::IDisk>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&, bool, bool) const build_asan/./src/Disks/ObjectStorages/RegisterDiskObjectStorage.cpp:27:64 openssl#39 0x56731159ef45 in decltype(std::declval<DB::registerDiskObjectStorage(DB::DiskFactory&, bool)::$_0&>()(std::declval<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&>(), std::declval<Poco::Util::AbstractConfiguration const&>(), std::declval<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&>(), std::declval<std::__1::shared_ptr<DB::Context const>>(), std::declval<std::__1::map<std: :__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::shared_ptr<DB::IDisk>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&>(), std::declval<bool>(), std::declval<bool>())) std::__1::__invoke[abi:v15000]<DB::regis terDiskObjectStorage(DB::DiskFactory&, bool)::$_0&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const>, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::shared_ptr<DB::IDisk>, std::__1::less<std::_ _1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&, bool, bool>(DB::registerDiskObjectStorage(DB::DiskFactory&, bool)::$_0&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_ string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const>&&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::shared_ptr<DB::IDisk>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&, bool&&, bool&&) build_asan/./contrib/llvm-project/libcxx/include/__functional/invoke.h:394:23 openssl#40 0x56731159ef45 in std::__1::shared_ptr<DB::IDisk> std::__1::__invoke_void_return_wrapper<std::__1::shared_ptr<DB::IDisk>, false>::__call<DB::registerDiskObjectStorage(DB::DiskFactory&, bool)::$_0&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const>, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::shared_ptr<DB::IDisk>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&, bool, bool>(DB::registerDiskObjectStorage(DB::DiskFactory&, bool)::$_0 &, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const>&&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::shared_ptr<DB::IDisk>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<ch ar>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&, bool&&, bool&&) build_asan/./contrib/llvm-project/libcxx/include/__functional/invoke.h:470:16 openssl#41 0x56731159ef45 in std::__1::__function::__default_alloc_func<DB::registerDiskObjectStorage(DB::DiskFactory&, bool)::$_0, std::__1::shared_ptr<DB::IDisk> (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const>, std::__1::map<std::__1::basic_string<char, s td::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::shared_ptr<DB::IDisk>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&, bool, bool)>::operator()[abi:v15000](std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator <char>> const&, Poco::Util::AbstractConfiguration const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context const>&&, std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::shared_ptr<DB::IDisk>, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::b asic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, std::__1::shared_ptr<DB::IDisk>>>> const&, bool&&, bool&&) build_asan/./contrib/llvm-project/libcxx/include/__functional/function.h:235:12 ``` (cherry picked from commit 8eaedf3)
The leak was reported in ClickHouse/ClickHouse#63792 - a SSL session is established - somewhere down in OpenSSL, the per-thread error queue is clear'ed - when no error queue exists (e.g. because the thread was just spawned), a new error queue is allocated - the error queue is stored in TLS, and a free handler is registered which deletes it when the thread ends - Leak sanitizer does not understand ^^ (false positive) ``` Direct leak of 9944 byte(s) in 11 object(s) allocated from: #0 0x5571bf7e04cf in malloc (/usr/bin/clickhouse+0xa39a4cf) (BuildId: 06c4931100f632dde9d0ecd3cf6a67776742e29b) ClickHouse#1 0x5571ecbc06be in CRYPTO_malloc build_docker/./contrib/openssl/crypto/mem.c:202:11 ClickHouse#2 0x5571ecbc06be in CRYPTO_zalloc build_docker/./contrib/openssl/crypto/mem.c:222:11 ClickHouse#3 0x5571ecb03c6a in ossl_err_get_state_int build_docker/./contrib/openssl/crypto/err/err.c:691:17 ClickHouse#4 0x5571ecb037b5 in ERR_clear_error build_docker/./contrib/openssl/crypto/err/err.c:339:10 ClickHouse#5 0x5571ec9cf0d0 in state_machine build_docker/./contrib/openssl/ssl/statem/statem.c:366:5 ClickHouse#6 0x5571ec90c7d4 in SSL_do_handshake build_docker/./contrib/openssl/ssl/ssl_lib.c:4746:19 ClickHouse#7 0x5571e70cc501 in Poco::Net::SecureSocketImpl::connectSSL(bool) build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:206:11 ClickHouse#8 0x5571e70cce6b in Poco::Net::SecureSocketImpl::connect(Poco::Net::SocketAddress const&, Poco::Timespan const&, bool) build_docker/./base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:149:2 ClickHouse#9 0x5571e70d81f7 in Poco::Net::SecureStreamSocketImpl::connect(Poco::Net::SocketAddress const&, Poco::Timespan const&) build_docker/./base/poco/NetSSL_OpenSSL/src/SecureStreamSocketImpl.cpp:87:8 ClickHouse#10 0x5571e0ca708a in DB::Connection::connect(DB::ConnectionTimeouts const&) build_docker/./src/Client/Connection.cpp:158:29 ``` (cherry picked from commit 9e7862c)
(cherry picked from commit b50f551)
ClickHouse issue https://github.com/ClickHouse/clickhouse-private/issues/10107#issuecomment-2189755698 reports this memory leak: (note how it is very similar to https://github.com/ClickHouse/clickhouse-private/issues/10107#issue-2314912657) ``` Direct leak of 528 byte(s) in 11 object(s) allocated from: #0 0x561369af24cf in malloc (/usr/bin/clickhouse+0xa6cf4cf) (BuildId: 22880fad595a96b17eb9add20e7a01f8ded54c49) ClickHouse#1 0x561397b86a7e in CRYPTO_malloc build_docker/./contrib/openssl/crypto/mem.c:202:11 ClickHouse#2 0x561397b86a7e in CRYPTO_zalloc build_docker/./contrib/openssl/crypto/mem.c:222:11 ClickHouse#3 0x561397be07cf in EVP_RAND_CTX_new build_docker/./contrib/openssl/crypto/evp/evp_rand.c:353:11 ClickHouse#4 0x561397be35fb in rand_new_drbg build_docker/./contrib/openssl/crypto/rand/rand_lib.c:665:11 ClickHouse#5 0x561397be2a9b in RAND_get0_private build_docker/./contrib/openssl/crypto/rand/rand_lib.c:827:16 ClickHouse#6 0x561397be296f in RAND_priv_bytes_ex build_docker/./contrib/openssl/crypto/rand/rand_lib.c:356:12 ClickHouse#7 0x5613978d7cd8 in SSL_CTX_new_ex build_docker/./contrib/openssl/ssl/ssl_lib.c:4016:13 ClickHouse#8 0x561392d1eabd in ossl_connect_common openssl.c ClickHouse#9 0x561392d11e23 in ssl_cf_connect vtls.c ClickHouse#10 0x561392c13a1f in cf_setup_connect connect.c ClickHouse#11 0x561392c1b0e5 in cf_hc_connect cf-https-connect.c ClickHouse#12 0x561392c0a332 in Curl_conn_connect (/usr/bin/clickhouse+0x337e7332) (BuildId: 22880fad595a96b17eb9add20e7a01f8ded54c49) openssl#13 0x561392c7a28a in multi_runsingle multi.c openssl#14 0x561392c78f6d in curl_multi_perform (/usr/bin/clickhouse+0x33855f6d) (BuildId: 22880fad595a96b17eb9add20e7a01f8ded54c49) openssl#15 0x561392bfd53e in curl_easy_perform (/usr/bin/clickhouse+0x337da53e) (BuildId: 22880fad595a96b17eb9add20e7a01f8ded54c49) openssl#16 0x561392a7c411 in Azure::Core::Http::CurlConnection::CurlConnection(Azure::Core::Http::Request&, Azure::Core::Http::CurlTransportOptions const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) build_docker/./contrib/azure/sdk/core/azure-core/src/http/curl/curl.cpp:2441:24 openssl#17 0x561392a6382b in std::__1::__unique_if<Azure::Core::Http::CurlConnection>::__unique_single std::__1::make_unique[abi:v15000]<Azure::Core::Http::CurlConnection, Azure::Core::Http::Request&, Azure::Core::Http::CurlTransportOptions const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&>(Azure::Core::Http::Request&, Azure::Core::Http::CurlTransportOptions const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) build_docker/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:714:32 openssl#18 0x561392a6382b in Azure::Core::Http::_detail::CurlConnectionPool::ExtractOrCreateCurlConnection(Azure::Core::Http::Request&, Azure::Core::Http::CurlTransportOptions const&, bool) build_docker/./contrib/azure/sdk/core/azure-core/src/http/curl/curl.cpp:2126:10 openssl#19 0x561392a61951 in Azure::Core::Http::CurlTransport::Send(Azure::Core::Http::Request&, Azure::Core::Context const&) build_docker/./contrib/azure/sdk/core/azure-core/src/http/curl/curl.cpp:351:48 openssl#20 0x561392b0879b in Azure::Core::Http::Policies::_internal::TransportPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/core/azure-core/src/http/transport_policy.cpp:121:40 openssl#21 0x561392aae81b in Azure::Core::Http::Policies::_internal::LogPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/core/azure-core/src/http/log_policy.cpp:114:23 openssl#22 0x561392b022d8 in Azure::Core::Http::Policies::_internal::RequestActivityPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/core/azure-core/src/http/request_activity_policy.cpp:110:23 openssl#23 0x561392b2e02a in Azure::Storage::_internal::SharedKeyPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/storage/azure-storage-common/inc/azure/storage/common/internal/shared_key_policy.hpp:36:25 openssl#24 0x561392bf7fd8 in Azure::Storage::_internal::StoragePerRetryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/storage/azure-storage-common/src/storage_per_retry_policy.cpp:57:23 openssl#25 0x561392bf8dcb in Azure::Storage::_internal::StorageSwitchToSecondaryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/storage/azure-storage-common/src/storage_switch_to_secondary_policy.cpp:36:32 openssl#26 0x561392aff0d9 in Azure::Core::Http::Policies::_internal::RetryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/core/azure-core/src/http/retry_policy.cpp:146:34 openssl#27 0x561392b08ed7 in Azure::Core::Http::Policies::_internal::TelemetryPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/core/azure-core/src/http/telemetry_policy.cpp:23:21 openssl#28 0x561392ae2fb5 in Azure::Core::Http::Policies::_internal::RequestIdPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/core/azure-core/inc/azure/core/http/policies/policy.hpp:453:27 openssl#29 0x561392b2e5fe in Azure::Storage::_internal::StorageServiceVersionPolicy::Send(Azure::Core::Http::Request&, Azure::Core::Http::Policies::NextHttpPolicy, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/storage/azure-storage-common/inc/azure/storage/common/internal/storage_service_version_policy.hpp:34:25 openssl#30 0x561392b7e0b1 in Azure::Core::Http::_internal::HttpPipeline::Send(Azure::Core::Http::Request&, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/core/azure-core/inc/azure/core/internal/http/pipeline.hpp:230:29 openssl#31 0x561392b7e0b1 in Azure::Storage::Blobs::_detail::BlobContainerClient::Create(Azure::Core::Http::_internal::HttpPipeline&, Azure::Core::Url const&, Azure::Storage::Blobs::_detail::BlobContainerClient::CreateBlobContainerOptions const&, Azure::Core::Context const&) build_docker/./contrib/azure/sdk/storage/azure-storage-blobs/src/rest_client.cpp:1415:36 openssl#32 0x561392b3de98 in Azure::Storage::Blobs::BlobContainerClient::Create(Azure::Storage::Blobs::CreateBlobContainerOptions const&, Azure::Core::Context const&) const build_docker/./contrib/azure/sdk/storage/azure-storage-blobs/src/blob_container_client.cpp:258:12 ``` - at database startup, Azure is registered as an object storage (--> registerAzureObjectStorage) - this calls into Azure, then into curl, and then into OpenSSL - curl asks OpenSSL for a bunch of random numbers (--> function 'ossl_random' in curl's OpenSSL wrapper) - OpenSSL initializes the random number generator and stores it in some random number generator context object (--> *RAND_get0_private) - this object is registered via pthread_key_create and pthread_setspecific registered in TLS - if registerAzureObjectStorage was the only place which initializes the RNG, we could argue that the leaked memory does not matter anyways as it is released after shutdown - RAND_get0_public also registers a free handler (rand_delete_thread_state) that runs in TLS, so the memory is released also if registration is called from arbitrary other threads. In sum: this is a false positive. As a result, the fix is similar to earlier fix ClickHouse@5c4b034 (cherry picked from commit 499f1ee)
(cherry picked from commit 6e1c68f)
Related MSan error log: ==2046343==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x556f1dce43f2 in sample_scalar /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/ml_kem/ml_kem.c:449:47 ClickHouse#1 0x556f1dce43f2 in matrix_expand /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/ml_kem/ml_kem.c:999:21 ClickHouse#2 0x556f1dcdec79 in genkey /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/ml_kem/ml_kem.c:1391:10 ClickHouse#3 0x556f1dcde895 in ossl_ml_kem_genkey /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/ml_kem/ml_kem.c:1879:15 ClickHouse#4 0x556f1dd71e1b in ml_kem_gen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/providers/implementations/keymgmt/ml_kem_kmgmt.c:771:13 ClickHouse#5 0x556f1da6add2 in evp_keymgmt_gen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/keymgmt_meth.c:464:11 ClickHouse#6 0x556f1da68160 in evp_keymgmt_util_gen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/keymgmt_lib.c:518:20 ClickHouse#7 0x556f1da8f2f4 in EVP_PKEY_generate /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/pmeth_gn.c:189:13 ClickHouse#8 0x556f1da570d4 in evp_pkey_keygen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/evp_lib.c:1216:15 ClickHouse#9 0x556f1da570d4 in EVP_PKEY_Q_keygen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/evp_lib.c:1242:11 ClickHouse#10 0x556f1dd763f8 in mlx_kem_gen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/providers/implementations/keymgmt/mlx_kmgmt.c:707:17 ClickHouse#11 0x556f1da6add2 in evp_keymgmt_gen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/keymgmt_meth.c:464:11 ClickHouse#12 0x556f1da68160 in evp_keymgmt_util_gen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/keymgmt_lib.c:518:20 openssl#13 0x556f1da8f2f4 in EVP_PKEY_generate /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/pmeth_gn.c:189:13 openssl#14 0x556f1da8f972 in EVP_PKEY_keygen /home/thevar1able/nvmemount/clickhouse/contrib/openssl/crypto/evp/pmeth_gn.c:274:12 openssl#15 0x556f1d8355b3 in ssl_generate_pkey_group /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/s3_lib.c:4935:9 openssl#16 0x556f1d884598 in add_key_share /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/statem/extensions_clnt.c:661:25 openssl#17 0x556f1d88417f in tls_construct_ctos_key_share /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/statem/extensions_clnt.c:766:18 openssl#18 0x556f1d87cdec in tls_construct_extensions /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/statem/extensions.c:910:15 openssl#19 0x556f1d8a777c in tls_construct_client_hello /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/statem/statem_clnt.c:1357:10 openssl#20 0x556f1d8a2465 in write_state_machine /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/statem/statem.c:902:26 openssl#21 0x556f1d8a2465 in state_machine /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/statem/statem.c:492:21 openssl#22 0x556f1d8a1536 in ossl_statem_connect /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/statem/statem.c:301:12 openssl#23 0x556f1d858378 in SSL_do_handshake /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/ssl_lib.c:5007:19 openssl#24 0x556f1d858680 in SSL_connect /home/thevar1able/nvmemount/clickhouse/contrib/openssl/ssl/ssl_lib.c:2243:12 openssl#25 0x556f1ab7f511 in Poco::Net::SecureSocketImpl::connectSSL(bool) /home/thevar1able/nvmemount/clickhouse/base/poco/NetSSL_OpenSSL/src/SecureS ocketImpl.cpp:205:11 openssl#26 0x556f1ab80143 in Poco::Net::SecureSocketImpl::connect(Poco::Net::SocketAddress const&, Poco::Timespan const&, bool) /home/thevar1able/nvme mount/clickhouse/base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp:148:2 openssl#27 0x556f1ab8dd4a in Poco::Net::SecureStreamSocketImpl::connect(Poco::Net::SocketAddress const&, Poco::Timespan const&) /home/thevar1able/nvme mount/clickhouse/base/poco/NetSSL_OpenSSL/src/SecureStreamSocketImpl.cpp:99:8 openssl#28 0x556f1ab3d96d in Poco::Net::StreamSocket::connect(Poco::Net::SocketAddress const&, Poco::Timespan const&) /home/thevar1able/nvmemount/clic khouse/base/poco/Net/src/StreamSocket.cpp:89:10 openssl#29 0x556f1aabfaa7 in Poco::Net::HTTPSession::connect(Poco::Net::SocketAddress const&) /home/thevar1able/nvmemount/clickhouse/base/poco/Net/src /HTTPSession.cpp:239:10 openssl#30 0x556f1ab55f54 in Poco::Net::HTTPSClientSession::connect(Poco::Net::SocketAddress const&) /home/thevar1able/nvmemount/clickhouse/base/poco/ NetSSL_OpenSSL/src/HTTPSClientSession.cpp:182:16 openssl#31 0x556f1aa86972 in Poco::Net::HTTPClientSession::reconnect(unsigned long*) /home/thevar1able/nvmemount/clickhouse/base/poco/Net/src/HTTPClie ntSession.cpp:471:13 openssl#32 0x556ee2448df8 in DB::EndpointConnectionPool<Poco::Net::HTTPSClientSession>::PooledConnection::doConnect(unsigned long*) /home/thevar1able/ nvmemount/clickhouse/src/Common/HTTPConnectionPool.cpp:515:22 openssl#33 0x556ee2448df8 in DB::EndpointConnectionPool<Poco::Net::HTTPSClientSession>::prepareNewConnection(DB::ConnectionTimeouts const&, unsigned l ong*) /home/thevar1able/nvmemount/clickhouse/src/Common/HTTPConnectionPool.cpp:690:25 openssl#34 0x556ee2445eed in DB::EndpointConnectionPool<Poco::Net::HTTPSClientSession>::getConnection(DB::ConnectionTimeouts const&, unsigned long*) / home/thevar1able/nvmemount/clickhouse/src/Common/HTTPConnectionPool.cpp:603:16 openssl#35 0x556ee248e8c9 in DB::makeHTTPSession(DB::HTTPConnectionGroupType, Poco::URI const&, DB::ConnectionTimeouts const&, DB::ProxyConfiguration const&, unsigned long*) /home/thevar1able/nvmemount/clickhouse/src/IO/HTTPCommon.cpp:63:29 openssl#36 0x556ee91f3da5 in DB::ReadWriteBufferFromHTTP::callImpl(Poco::Net::HTTPResponse&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::optional<DB::ReadWriteBufferFromHTTP::HTTPRange> const&, bool) const /home/thevar1able/nvmemount/clic khouse/src/IO/ReadWriteBufferFromHTTP.cpp:272:20 openssl#37 0x556ee91f44b9 in DB::ReadWriteBufferFromHTTP::callWithRedirects(Poco::Net::HTTPResponse&, std::__1::basic_string<char, std::__1::char_trai ts<char>, std::__1::allocator<char>> const&, std::__1::optional<DB::ReadWriteBufferFromHTTP::HTTPRange> const&) /home/thevar1able/nvmemount/clickho use/src/IO/ReadWriteBufferFromHTTP.cpp:290:19 openssl#38 0x556ee91f6182 in DB::ReadWriteBufferFromHTTP::initialize() /home/thevar1able/nvmemount/clickhouse/src/IO/ReadWriteBufferFromHTTP.cpp:413:1 9 (cherry picked from commit 2720d8c)
x25519_scalar_mult and related functions may use assembly implementations (x25519-x86_64.s) that MSan cannot instrument. Add __msan_unpoison annotations after assembly writes, following the same pattern used in sha3.c, bn_intern.c, and eng_rdrand.c. (cherry picked from commit f3b2f02)
OSSL_IMPLEMENT_GETAUXVAL is only enabled for glibc >= 2.16, Android, FreeBSD and OpenBSD, so on musl OPENSSL_cpuid_setup fell back to the brute-force SIGILL-based probing: install a SIGILL handler, execute each optional instruction, and siglongjmp out of the handler when it traps. That scheme breaks under ThreadSanitizer with static libc interception: the sigaction/sigsetjmp/siglongjmp round-trip through TSan's interceptors during a library constructor leads to a null pointer call inside the probe, an unrecoverable startup failure in every TSan aarch64 musl binary (OPENSSL_cpuid_setup runs as an __attribute__((constructor)) before main). musl has always provided an unversioned getauxval, so take the same HWCAP-based path as glibc. This also removes the last SIGILL-probing user in the binary and keeps CPU detection free of signal-handler tricks. The __MUSL__ macro is defined globally by the ClickHouse musl toolchain files. (cherry picked from commit 26868a3)
CLAassistant
commented
Sep 3, 2026
Viktor Dukhovni seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps our OpenSSL fork from 3.5.7 to upstream openssl-3.5.8, carrying
forward all ClickHouse-specific patches via cherry-pick.
CVEs fixed
Changes
ClickHouse/openssl-3.5.8from the upstreamopenssl-3.5.8tag.ClickHouse/openssl-3.5.7onto the new base.crypto/rand/rand_lib.cto preserve both the upstream change andthe existing patch's intent.
Testing