[aidankeefe2022]

Description

With WOLFSSL_STATIC_MEMORY, ssl->heap is a per-connection heap hint that wolfSSL_free() releases. A WOLFSSL_SESSION can live longer than its SSL (wolfSSL_get1_session(), the session cache, resumption on a new SSL). Memory tied to the session was being taken from or returned to ssl->heap, so a retained session could point at memory from a pool that was already gone.

• InitSSL / wolfSSL_clear: create the session with ctx->heap.
• SetTicket, DoFinished, AddPSKtoPreMasterSecret: allocate and free session tickets and ticket nonces with ssl->session->heap. One of these frees passed NULL as the heap.
• PushPeerCertToChain: build the chain certs, including the leaf the server keeps as session->peer, from ssl->session->heap. Copy the leaf with wolfSSL_X509_d2i_ex() rather than wolfSSL_X509_dup(), because the dup inherits peerCert's heap, which is ssl->heap.

Testing

Add tests for get1_session/clear/SESSION_dup, for static and dynamic session tickets across resumption, and for the server's peer cert after wolfSSL_free(). Each test checks the session heap pointers, and where stats are tracked, that curAlloc returns to its baseline.

[Copilot]

🟡 Changes recommended

The new regression tests need configuration fixes for builds without PEM parsing or TLS 1.2 client authentication.

2 open issues

• Use CERT_FILETYPE when WOLFSSL_PEM_TO_DER is disabled · New
• Skip test when WOLFSSL_NO_CLIENT_AUTH is defined · New

What changed in this PR

This PR fixes session memory ownership so retained sessions do not depend on a connection’s freed static-memory heap hint.

Changes:

• Create sessions using the context heap during initialization and reset.
• Use the session heap for tickets, ticket nonces, and retained peer certificates.
• Add regression tests for session retention, duplication, resumption, and cleanup.

File	Description
tests/​api.c	Adds static-memory session lifetime and cleanup tests.
src/​ssl.c	Uses the context heap when wolfSSL_clear() replaces a session.
src/​ssl_api_cert.c	Allocates peer-chain certificates from the session heap.
src/​internal.c	Corrects session creation and ticket-related heap usage.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11899

Scan targets checked: wolfssl-src, wolfssl-bugs
Coverage: 2 of 4 in-scope changed file(s) opened by the reviewer; not opened: src/internal.c, tests/api.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +4 B (+0.0%, 130,745 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text -64 B (-0.0%, 249,230 B / 262,144 B, total: 95% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[julek-wolfssl]

This is not a maintainable solution. Caller sites should not have knowledge about which hint to use. I would prefer to store a reference counter in WOLFSSL_HEAP_HINT and let the allocator figure out when it can be released. Attached is a detailed description of what I envision.

pr11899-heap-hint-refcount.md