Suppress leaks from OpenSSL in Valgrind

create a supressions file openssl.supp
run valgrind with the suppressions file valgrind --suppressions=openssl.supp

Suppressions file

{
    libssl-leaks
    Memcheck:Leak
    ...
    obj:*/libssl.so*
}
{
    libcrypto-leaks
    Memcheck:Leak
    ...
    obj:*/libcrypto.so*
}

Explanation

libssl-leaks - suppression name
Memcheck:Leak - a Memcheck suppression type Leak, meaning a memory leak
... - frame-level wildcard
obj:*/libssl.so* - matches object libcrypto.so (for example /usr/lib/x86_64-linux-gnu/libssl.so.3)

This way, if a leak occurs anywhere within libssl.so (note the frame-level wildcard ...), the leak is supressed

Example valgrind output

When we compile and run leak.c:

#include <openssl/ssl.h>
#include <openssl/err.h>

int main() {
    SSL_CTX *ctx = SSL_CTX_new(TLS_method());
    (void)ctx;
}

Then valgrind output looks like:

==6017== HEAP SUMMARY:
==6017==     in use at exit: 15,898 bytes in 242 blocks
==6017==   total heap usage: 8,904 allocs, 8,662 frees, 815,102 bytes allocated
==6017==
==6017== LEAK SUMMARY:
==6017==    definitely lost: 0 bytes in 0 blocks
==6017==    indirectly lost: 0 bytes in 0 blocks
==6017==      possibly lost: 0 bytes in 0 blocks
==6017==    still reachable: 0 bytes in 0 blocks
==6017==         suppressed: 15,898 bytes in 242 blocks
==6017==
==6017== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 1 from 1)
--6017--
--6017-- used_suppression:     41 libssl-leaks openssl.supp:2 suppressed: 30,151 bytes in 239 blocks
--6017-- used_suppression:      3 libcrypto-leaks openssl.supp:8 suppressed: 29 bytes in 3 blocks
==6017==
==6017== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 1 from 1)

Useful links

https://wiki.wxwidgets.org/Valgrind_Suppression_File_Howto

https://valgrind.org/docs/manual/mc-manual.html#mc-manual.suppfiles

https://valgrind.org/docs/manual/manual-core.html#manual-core.suppress

Versions

At the time of writing, I am using:

Valgrind 3.23.0
OpenSSL 3.0.14 4 Jun 2024