From cb30758247825b770d0cdb431bc4c7576df852df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C5=8Dan?= Date: Thu, 19 Feb 2026 00:19:09 -0700 Subject: [PATCH 1/2] fix: generate_key() BIGNUM leak on OpenSSL 3.x The exponent BIGNUM `e` was set to NULL before calling BN_free(), making the free a no-op and leaking the BIGNUM on every key generation. EVP_PKEY_CTX_set1_rsa_keygen_pubexp() copies the BIGNUM (set1 semantics), so the caller retains ownership and must free it. Co-Authored-By: Claude Opus 4.6 --- RSA.xs | 1 - 1 file changed, 1 deletion(-) diff --git a/RSA.xs b/RSA.xs index ffb3325..4eb73f4 100644 --- a/RSA.xs +++ b/RSA.xs @@ -530,7 +530,6 @@ generate_key(proto, bitsSV, exponent = 65537) CHECK_OPEN_SSL(EVP_PKEY_generate(ctx, &rsa) == 1); CHECK_OPEN_SSL(rsa != NULL); - e = NULL; BN_free(e); EVP_PKEY_CTX_free(ctx); #endif From 75fef760fb52b8ac5cacf19a314a35944d0bbebc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C5=8Dan?= Date: Tue, 24 Feb 2026 23:08:11 -0700 Subject: [PATCH 2/2] rebase: apply review feedback on #78 --- RSA.xs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/RSA.xs b/RSA.xs index 4eb73f4..a3a6034 100644 --- a/RSA.xs +++ b/RSA.xs @@ -530,7 +530,8 @@ generate_key(proto, bitsSV, exponent = 65537) CHECK_OPEN_SSL(EVP_PKEY_generate(ctx, &rsa) == 1); CHECK_OPEN_SSL(rsa != NULL); - BN_free(e); + if (e != NULL) + BN_free(e); EVP_PKEY_CTX_free(ctx); #endif CHECK_OPEN_SSL(rsa);