Fixes memory leak in RSA-Signer

[Fahrenholz]

A SSL-Key-resource was created and never freed, thus creating a memory leak. This pull request fixes it by freeing the resource.

[Ocramius]

Please revert this to private

[Ocramius]

You can drop 235d487 to achieve that

[Fahrenholz]

@Ocramius Changes done. I'ld still change this method from private to protected, thus making overloading and using it in a child-class possible.

[Ocramius]

This class is not designed for inheritance: another interface implementation is the correct approach here

[lcobucci]

@Fahrenholz thanks for your patch. I have a question, though. Shouldn't we call openssl_pkey_free() after creating the signature with the private key as well?

[Fahrenholz]

@lcobucci Hm, yes, that would be good as it creates a new resource. I updated my PR.

[lcobucci]

@Fahrenholz sorry about my delay, I have just one more question =)

Do you know of any reliable way to test this?

[lcobucci]

@Fahrenholz 🚢

We can try to add tests in another PR, I'll be backporting this to 3.3 now. Thanks for your help!

[Fahrenholz]

@lcobucci : I don't really know of a way to test it unfortunately. I can tell you how I found out: We had a long running process, with reactPHP as a server. After every request, we verified the included JWT in order to authenticate the user. And so after every 100 requests we saw that the PHP process had slightly grown, eventually getting so big every one or two weeks that it killed the container.

Maybe a strategy would be to performance test it with jmeter or gatling.

[Ocramius]

A test that instantiates the stack a thousand times and measures memory at 0, 500 and 1000 cycles (and expexts 1000===500 in memory usage) would be enough

…

On Sun, 9 Sep 2018, 20:49 Vincent Fahrenholz, ***@***.***> wrote: @lcobucci </~https://github.com/lcobucci> : I don't really know of a way to test it unfortunately. I can tell you how I found out: We had a long running process, with reactPHP as a server. After every request, we verified the included JWT in order to authenticate the user. And so after every 100 requests we saw that the PHP process had slightly grown, eventually getting so big every one or two weeks that it killed the container. Maybe a strategy would be to performance test it with jmeter or gatling. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#260 (comment)>, or mute the thread </~https://github.com/notifications/unsubscribe-auth/AAJakJr02rKGgXmCZZHnNy20-WPe4kiIks5uZWKfgaJpZM4WFUbt> .