Run the following code:

import socket
import ssl
import sys


def main():
    ctx = ssl.create_default_context()
    s = socket.create_connection(('www.bing.com', 443))
    s = ctx.wrap_socket(s, server_hostname='www.bing.com')
    while True:
        s.getpeercert()

        sys.stderr.write('.')
        sys.stderr.flush()


if __name__ == '__main__':
    main()

and observe memory usage, you'll see it increases by a MB/s or so.

A probably source of the leak is here: https://github.com/python/cpython/blob/master/Modules/_ssl.c#L1073-L1076 dps is never freed. (This is with OpenSSL 0.9.8zg)

Hi Alex,

not sure, but I think the right function to free the memory is AUTHORITY_INFO_ACCESS_free(dps)

I will provide a patch for a review asap

I think you want sk_DIST_POINT_free actually.

Maybe you are right, I didn't see that this function returns a pointer in function of the parameter. sorry.

Could you try with this patch, really sorry but my internet connection is really slow and I have a problem with the _ssl module on my laptop (problem with the compilation and the dependencies because I am on OSX).

Thank you

Tests pass and the original script runs without a leak using this patch. It could probably be shorter if we converted from local returns to goto fail or something, but I don't really have an opinion.

Hi alex,

Thank you for your feeback, I will propose an other patch with your remarks.

Stephane

sorry for the delay.

here is a new version of my patch, if I can have feedback about this patch, I will really appreciate.

thank you

New changeset 10c3646b2d59 by Benjamin Peterson in branch '2.7':
fix memory leak in _get_crl_dp (closes bpo-25569)
https://hg.python.org/cpython/rev/10c3646b2d59

New changeset aabe273b20ab by Benjamin Peterson in branch '3.4':
fix memory leak in _get_crl_dp (closes bpo-25569)
https://hg.python.org/cpython/rev/aabe273b20ab

New changeset 07a298572d93 by Benjamin Peterson in branch '3.5':
merge 3.5 (bpo-25569)
https://hg.python.org/cpython/rev/07a298572d93

New changeset fb55b1ab43fc by Benjamin Peterson in branch 'default':
merge 3.5 (bpo-25569)
https://hg.python.org/cpython/rev/fb55b1ab43fc

Seems to have broken the SSL module. Looks like you typoed “dps” as “dsp” in some conditional code.

http://buildbot.python.org/all/builders/AMD64%20Snow%20Leop%203.4/builds/1326/steps/compile/logs/stdio

building '_ssl' extension
gcc -fno-strict-aliasing -g -O0 -Wall -Wstrict-prototypes -Werror=declaration-after-statement -I./Include -I. -IInclude -I/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Include -I/Users/buildbot/buildarea/3.4.murray-snowleopard/build -c /Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c -o build/temp.macosx-10.6-x86_64-3.4-pydebug/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.o
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c: In function ‘_get_crl_dp’:
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:1084: error: ‘dsp’ undeclared (first use in this function)
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:1084: error: (Each undeclared identifier is reported only once
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:1084: error: for each function it appears in.)
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c: In function ‘_setup_ssl_threads’:
/Users/buildbot/buildarea/3.4.murray-snowleopard/build/Modules/_ssl.c:3828: warning: comparison is always false due to limited range of data type

New changeset 3b9fb8ebf44f by Benjamin Peterson in branch '2.7':
fix build with older openssl (bpo-25569)
https://hg.python.org/cpython/rev/3b9fb8ebf44f

New changeset f13a75544b6f by Benjamin Peterson in branch '3.4':
fix build with older openssl (bpo-25569)
https://hg.python.org/cpython/rev/f13a75544b6f

New changeset 83ea7e75605a by Benjamin Peterson in branch '3.5':
merge 3.4 (bpo-25569)
https://hg.python.org/cpython/rev/83ea7e75605a

New changeset 8ac09e46ca45 by Benjamin Peterson in branch 'default':
merge 3.5 (bpo-25569)
https://hg.python.org/cpython/rev/8ac09e46ca45

fixed