From e7c83477dc9e36157337624d53db7ab8a68cd124 Mon Sep 17 00:00:00 2001 From: Malte Ubl Date: Wed, 28 Oct 2026 10:56:59 -0700 Subject: [PATCH] Suppress OpenSSL's default-verify-path store in the sanitized lane 6883-node-island-builtin-handles builds a Headers inside an island, undici loads node:tls for the builtin classes it backs, and OpenSSL parses the system CA bundle through PEM/X509. That state is freed only by OPENSSL_cleanup at exit, which NI-7c keeps off, and the stacks carry no node::crypto frame, so the existing entries cannot match. Name OpenSSL's allocator entry points, as the file already does for the rest of libnode's process-lifetime state. Co-Authored-By: Claude Opus 5.5 --- tests/harness/lsan.supp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/harness/lsan.supp b/tests/harness/lsan.supp index a0fe1c5ae..ba2af663f 100644 --- a/tests/harness/lsan.supp +++ b/tests/harness/lsan.supp @@ -23,3 +23,12 @@ leak:node::crypto::LoadCertsFromBIO # The certificates' lazily decoded keys, cached in them when a root store # is built. leak:node::crypto::NewRootCertStore +# The same policy covers OpenSSL's own default-verify-path store, which a +# TLS context created inside an island loads on its own: undici needs TLS +# for the builtin classes it backs (Headers, Request, Response), and OpenSSL +# then parses the system CA bundle through PEM/X509 with no node::crypto +# frame in the stack, so the entries above cannot match. That state is +# likewise freed only by OPENSSL_cleanup at exit, which NI-7c keeps off, so +# it is named here by OpenSSL's allocator entry points instead. +leak:CRYPTO_malloc +leak:CRYPTO_zalloc