This article is contributed. See the original author and article here.
The 20.07 and 20.08 Update 1 versions of the Azure Sphere OS contain a bug that results in a memory leak for applications that use HTTPS connections via libcurl. This leak does not occur for HTTP (non-HTTPS) connections, Azure IoT C SDK connections, nor MQTT connections. Additionally, this leak does not occur when using the wolfSSL API directly to create a connection
The amount of data leaked is variable, depending on how the cURL handle is configured. We expect that it will be approximately tens of bytes leaked per HTTPS transaction.
The 20.09 OS release will include a fix for this bug. In the meantime, you can mitigate the problem by implementing a workaround.
Workaround
To work around this bug, disable the CURLOPT_SSL_SESSIONID_CACHE option when you create cURL handles. To do so, set the following option after cURL handle creation and once for each handle:
curl_easy_setopt(curlHandle, CURLOPT_SSL_SESSIONID_CACHE, 0);
For more details on how to do this, see CURLOPT_SSL_SESSIONID_CACHE explained in the cURL documentation.
This workaround will continue to work with the 20.09 release, but you may prefer to revert the workaround so that you can enable SSL session ID caching.
Solution
The fix for this will be part of the 20.09 release, and the fix will take effect whether the OS is delivered as an OTA update or via recovery. After the device has updated to 20.09, you can either revert applications that use the workaround to enable SSL session ID caching, or you can leave it disabled.
Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.
Recent Comments