From 800678db5674b0321f63fb420f942fb543b8d722 Mon Sep 17 00:00:00 2001 From: Jacob Champion Date: Mon, 20 Apr 2026 15:29:54 -0700 Subject: [PATCH] Remove call to BIO_get_new_index() in OpenSSL code BIO_meth_new() takes an "index type" as its first argument. Older OpenSSL documentation used to suggest that this argument should be constructed by registering a custom index with BIO_get_new_index() and combining that with the appropriate "BIO class" bit. However, custom BIO indices are an extremely limited resource [1], and newer documentation suggests that clients should only take one if they expect to search a BIO chain for it later: `type` can be set to either `BIO_TYPE_NONE` or via BIO_get_new_index() if a unique type is required for searching[...] Note that BIO_get_new_index() can only be used 127 times before it returns an error. We don't fall into that category (we immediately discard the index we've created), and it doesn't look like OpenSSL has ever required a nonzero index, so avoid registering one altogether. Per complaint by Daniel Schreiber that libpq eventually breaks OpenSSL when repeatedly dlopen/dlclose'd. It's not clear to me that we support that use case in general (related TODO: decide whether to backpatch this), but this change seems like a clear improvement going forward. [1] https://github.com/openssl/openssl/issues/23655 Reported-by: Daniel Schreiber Discussion: https://postgr.es/m/f7fe39b3-7e99-4939-8852-07350549161d%40hrz.tu-chemnitz.de Backpatch-through: TODO --- src/backend/libpq/be-secure-openssl.c | 9 ++------- src/interfaces/libpq/fe-secure-openssl.c | 8 +------- 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index a3e222f3a3d..6c3717bc024 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -1419,13 +1419,8 @@ port_bio_method(void) { if (!port_bio_method_ptr) { - int my_bio_index; - - my_bio_index = BIO_get_new_index(); - if (my_bio_index == -1) - return NULL; - my_bio_index |= BIO_TYPE_SOURCE_SINK; - port_bio_method_ptr = BIO_meth_new(my_bio_index, "PostgreSQL backend socket"); + port_bio_method_ptr = BIO_meth_new(BIO_TYPE_SOURCE_SINK, + "PostgreSQL backend socket"); if (!port_bio_method_ptr) return NULL; if (!BIO_meth_set_write(port_bio_method_ptr, port_bio_write) || diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index fbd3c63fb5d..2214a141847 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -1841,13 +1841,7 @@ pgconn_bio_method(void) if (!pgconn_bio_method_ptr) { - int my_bio_index; - - my_bio_index = BIO_get_new_index(); - if (my_bio_index == -1) - goto err; - my_bio_index |= BIO_TYPE_SOURCE_SINK; - res = BIO_meth_new(my_bio_index, "libpq socket"); + res = BIO_meth_new(BIO_TYPE_SOURCE_SINK, "libpq socket"); if (!res) goto err; -- 2.34.1