From bdf7f9b5618caece31c22cd8d2a2bdf3100106c2 Mon Sep 17 00:00:00 2001 From: Daniel Gustafsson Date: Tue, 6 Oct 2026 13:27:12 +0200 Subject: [PATCH] Delay creation of SSL_CTX structure to allow cleanup Avoid initializing the OpenSSL SSL_CTX structure for a new host until it has been checked for errors. The cleanup can only see hosts which were successfully added so the previous coding would leak the SSL_CTX on failed reloads. Author: Zsolt Parragi Reviewed-by: Daniel Gustafsson Reviewed-by: Rui Zhao Discussion: https://postgr.es/m/A1745424-7110-41E9-B98C-3CED1A034A8F@yesql.se Backpatch-through: 19 --- src/backend/libpq/be-secure-openssl.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index c8168949f25..9a29f0cfb6d 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -255,9 +255,6 @@ be_tls_init(bool isServerStart) { HostsLine *host = lfirst(line); - if (!init_host_context(host, isServerStart)) - goto error; - /* * The hostname in the config will be set to NULL for the default * host as well as in configs used for non-SNI connections. Lists @@ -327,6 +324,14 @@ be_tls_init(bool isServerStart) */ new_hosts->sni = lappend(new_hosts->sni, host); } + + /* + * Create the SSL context only once the entry has been accepted + * and added to new_hosts, as the cleanup callback can only free + * contexts of entries it can reach from there. + */ + if (!init_host_context(host, isServerStart)) + goto error; } }