From 4ad0562b00a5f8796663e3fa498e99a9b533f57e Mon Sep 17 00:00:00 2001 From: Ruben Bridgewater Date: Wed, 22 Jul 2026 22:57:37 +0200 Subject: [PATCH] crypto: stop clearing OpenSSL compression methods OpenSSL allocates the built-in record-compression methods while creating its global context. Clearing the stack drops the only pointers without freeing the entries, so LeakSanitizer reports a 24-byte leak at process shutdown. OpenSSL disables record compression on every new SSL_CTX by default. Node does not expose SSL_CTX_clear_options(), so the extra process-wide clearing is not needed to protect against CRIME. Refs: https://github.com/nodejs/node/pull/62217 Signed-off-by: Ruben Bridgewater --- src/crypto/crypto_util.cc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc index 711984e5e4f23f..138e8c25dd4042 100644 --- a/src/crypto/crypto_util.cc +++ b/src/crypto/crypto_util.cc @@ -178,10 +178,6 @@ void InitCryptoOnce() { #endif // OPENSSL_IS_BORINGSSL - // Turn off compression. Saves memory and protects against CRIME attacks. - // No-op with OPENSSL_NO_COMP builds of OpenSSL. - sk_SSL_COMP_zero(SSL_COMP_get_compression_methods()); - #ifndef OPENSSL_NO_ENGINE EnginePointer::initEnginesOnce(); #endif // !OPENSSL_NO_ENGINE