#1774·libevent

Segmentation fault in `bufferevent_openssl_socket_new`

Author: eriklaxCreated Jan 15, 2025Updated May 25, 2026
Labelsstatus:confirmedsubsystem:ssl

In cases where bufferevent_openssl_socket_new would return an error (NULL) it crashes due to bad cleanup inside of bufferevent_ssl_new_impl.

For example, by triggering this error, it causes a segmentation fault

[warn] UNLOCK_CALLBACKS requires DEFER_CALLBACKS Segmentation fault

c
		bev = bufferevent_openssl_socket_new(
			base, fd, ssl, state, BEV_OPT_UNLOCK_CALLBACKS);

Also, related to cleanup, I couldn't find in the manual and had to dig deep in the code to figure out who is responsible of freeing up both the fd argument (close) and the ssl object in case of an error. I found it to be libevent intent to do so (based on the BEV_OPT_CLOSE_ON_FREE flag).

That behavior seems different from bufferevent_socket_new where it does not close the fd on error. Is that correct and intentional? I understand that it may not be possible to break that contract moving forward.