stunnel-users

Download

[email protected]

October 2026

2 participants
2 discussions

[PATCH] Fix memory leak in create_pid() error path (src/ui_unix.c)
by Chhabra, Simranjeet Singh 08 Oct '26

08 Oct '26

Hello, While importing stunnel 5.82 we found a leak in create_pid() in src/ui_unix.c. If write() to the pid file comes up short, the function returns 1 without releasing the buffer allocated by str_printf(): ----- pid=str_printf("%lu\n", (unsigned long)getpid()); if(write(pf, pid, strlen(pid))<(int)strlen(pid)) { s_log(LOG_ERR, "Cannot write pid file %s", global_options.pidfile); ioerror("write"); (void)close(pf); return 1; /* pid is not released */ } str_free(pid); /* released on the success path */ (void)close(pf); ----- 5.82 added (void)close(pf) to this error path, which fixed the descriptor leak. The matching str_free(pid) is still missing, so the error path and the success path release different things. The impact is minor: this path is only reached at startup when the pid file cannot be written, and stunnel exits right after. Still, the fix is one line and makes both paths release the same resources. Patch against 5.82: ----- --- a/src/ui_unix.c +++ b/src/ui_unix.c @@ -284,6 +284,7 @@ NOEXPORT int create_pid(void) { if(write(pf, pid, strlen(pid))<(int)strlen(pid)) { s_log(LOG_ERR, "Cannot write pid file %s", global_options.pidfile); ioerror("write"); + str_free(pid); (void)close(pf); return 1; } ----- Could you consider this for the next release? If you would prefer the patch in a different form, I am happy to resend it. Best, Simranjeet Get Outlook for Mac<https://aka.ms/GetOutlookForMac>

1 0

"Connection reset by peer" Log Spam Issue with 5.82 on OS X
by H. Thiele 08 Oct '26

08 Oct '26

Hi there, I recently updated my stunnel installation from 5.70 to the latest 5.82, but an issue has popped up. Nothing else was changed on my system, just stunnel. In my case I use stunnel on an older OS X (yes, that's pre-"macOS") as glue between an outdated Mail client and the world "protected" with modern TLS. Basically Mail connects to stunnel locally which then does the "modern" TLS connection to various provider's mail servers (gmail, etc.) I use 'debug = 4' in stunnel.conf as long nothing is broken. With the old 5.70 the log usually stayed entirely silent that way. Now with 5.82 I see a lot of this: … 2026.10.07 23:03:00 LOG3[871]: transfer_tcp: SSL_read: Connection reset by peer (54) 2026.10.07 23:03:00 LOG3[866]: transfer_tcp: SSL_read: Connection reset by peer (54) 2026.10.07 23:03:00 LOG3[873]: transfer_tcp: SSL_read: Connection reset by peer (54) 2026.10.07 23:03:00 LOG3[869]: transfer_tcp: SSL_read: Connection reset by peer (54) 2026.10.08 01:11:57 LOG3[921]: transfer_tcp: SSL_read: Connection reset by peer (54) 2026.10.08 01:11:57 LOG3[925]: transfer_tcp: SSL_read: Connection reset by peer (54) … It seems to happen to about 20% of all connections/transfers. Investigating further with 'debug = 4' disabled/commented out: … 2026.10.06 18:33:50 LOG5[11]: Connection closed: 85 byte(s) sent to TLS, 264 byte(s) sent to socket 2026.10.06 18:33:50 LOG3[12]: transfer_tcp: SSL_read: Connection reset by peer (54) 2026.10.06 18:33:50 LOG5[12]: Connection reset: 85 byte(s) sent to TLS, 264 byte(s) sent to socket 2026.10.06 18:33:50 LOG3[13]: transfer_tcp: SSL_read: Connection reset by peer (54) 2026.10.06 18:33:50 LOG5[13]: Connection reset: 85 byte(s) sent to TLS, 264 byte(s) sent to socket … Note: #11 is OK, #12 and #13 have the error. Considering they all do the same: contact the server, ask for new mail, and (usually) get an answer of "no new mail" it looks like the error randomly pops up when things are finished? I don't notice any problems inside the Mail client, so all is OK at that end at least. I'm not sure if there's an actual problem here or if this is purely log noise. Any help appreciated. Thanks! regards, H. Thiele -- (a streamlined part of my stunnel.conf for reference) setuid = nobody setgid = nogroup foreground = yes output = /var/log/stunnel.log syslog = no debug = 4 client = yes CAfile = /usr/local/etc/openssl/cert.pem verifyChain = yes sslVersionMin = TLSv1.3 delay = yes [gmx-pop3] accept = 127.0.0.1:41001 connect = pop.gmx.com:995 checkHost = pop.gmx.com [gmx-smtp] accept = 127.0.0.1:41002 connect = mail.gmx.com:465 checkHost = mail.gmx.com [webde-pop3] accept = 127.0.0.1:41003 connect = pop3.web.de:995 checkHost = pop3.web.de [webde-smtp] accept = 127.0.0.1:41004 connect = smtp.web.de:465 checkHost = smtp.web.de [yahoo-pop3] accept = 127.0.0.1:41005 connect = pop.mail.yahoo.com:995 checkHost = pop.mail.yahoo.com [yahoo-smtp] accept = 127.0.0.1:41006 connect = smtp.mail.yahoo.com:465 checkHost = smtp.mail.yahoo.com [gmail-pop3] accept = 127.0.0.1:41007 connect = pop.gmail.com:995 checkHost = pop.gmail.com [gmail-smtp] accept = 127.0.0.1:41008 connect = smtp.gmail.com:465 checkHost = smtp.gmail.com [t-online-pop3] accept = 127.0.0.1:41009 connect = securepop.t-online.de:995 checkHost = securepop.t-online.de [t-online-smtp] accept = 127.0.0.1:41010 connect = securesmtp.t-online.de:465 checkHost = securesmtp.t-online.de ; … [cut the rest of the file for privacy reasons, but more services like above follow here] …

1 0