ssl证书验证上的多线程c++应用程序内存泄漏

我们在多线程c++应用程序中使用openssl库。只有在启用SSL证书验证的情况下，由于内存泄漏，应用程序才会在3天内耗尽所有内存（7 GB实例）。

请在这里找到我的申请流程：

在应用程序启动时，我们创建了150个线程，用于同步3万用户数据，并为每个线程保留一个SSL_CTX_new对象。重复使用同一个对象，直到进程终止。对象SSL_CTX_new只在线程初始化时创建一次，它将被重新用于所有后续的SSL连接。

我们在处理用户数据方面做了以下工作：

线程通过ssl创建一个到第三方服务器的新套接字连接，一旦从第三方server获取了所需的数据，ssl连接就会终止。类似地，所有线程每次从队列中提取一个用户，并从服务器获取数据。

我们必须为所有3万用户进行上述连接、获取数据和断开ssl连接。

请找到我们应用程序的伪代码示例：

ThreadTask() 
{
    ssldata* ssl_data;
   1. Creates SSL connection: user_ssl_new_connect(ssl_data)
   2. Fetch users data
   3. Terminate ssl connection: ssl_abort()
}

char* user_ssl_new_connect(ssldata* ssl_data)  {
  SSL_CTX *ssl_context = InitsslonePerThread();
  if (!ssl_context) {
    if (!(ssl_context = SSL_CTX_new (SSLv23_client_method ()) {
      retur NULL;
    } 
  } 
  SSL_CTX_set_options (ssl_context,SSL_OP_NO_COMPRESSION|SSL_MODE_RELEASE_BUFFERS);
  SSL_CTX_set_verify (ssl_context,SSL_VERIFY_PEER,ssl_open_verify);
  SSL_CTX_set_default_verify_paths (ssl_context);
  char * s = "sslpath"
  SSL_CTX_load_verify_locations (ssl_context,s,NIL);
  SetsslconnectionPerThread(ssl_context);
  if (!(ssl_data->sslconnection = (SSL *) SSL_new (ssl_context)))
    return NULL
  bio = BIO_new_socket (ssl_data->sockettcpsi,BIO_NOCLOSE);
  SSL_set_bio (ssl_data->sslconnection,bio,bio);
  SSL_set_connect_state(ssl_data->sslconnection);
  if (SSL_in_init(ssl_data->sslconnection)) SSL_total_renegotiations (ssl_data->sslconnection);
      /* now negotiate SSL */
  if ((retval = SSL_write (ssl_data->sslconnection,"",0)) < 0) {    
    return NULL
  }
      /* validating host names? */
  if ((err = ssl_validate_cert (cert = SSL_get_peer_certificate   (sslconnection),host))) {
      return NULL;
  }
}

// one ssl_context per thread in global variable 
ssl_context* InitsslonePerThread() {
  yULong threadid;
  threadid = (unsigned long) pthread_self();
  if ssl_context is not created for this threadid
     returns new ssl_context.
  else 
    returns previous ssl_context.
}
void SetsslconnectionPerThread(ssl_context*) {
  yULong threadid;
  threadid = (unsigned long) pthread_self();
  #setting ssl_context in global variable 
}

long ssl_abort (ssldata* ssl_data)
{
   if (ssl_data->sslconnection) {        /* close SSL connection */
        SSL_shutdown (ssl_data->sslconnection);
        SSL_free (ssl_data->sslconnection);
    }
    return NIL;
}

static char *ssl_validate_cert (X509 *cert,char *host)
{
    int i,n;
    char *s,*t,*ret;
    void *ext;
    GENERAL_NAME *name;
    char tmp[MAILTMPLEN];
    /* make sure have a certificate */
    if (!cert) ret = "No certificate from server";
    /* and that it has a name */
    else if (!cert->name) ret = "No name in certificate";
    /* locate CN */
    else if (s = strstr (cert->name,"/CN=")) {
        if (t = strchr (s += 4,'/')) *t = '';
        /* host name matches pattern? */
        ret = ssl_compare_hostnames (host,s) ? NIL :
              "Server name does not match certificate";
        if (t) *t = '/';        /* restore smashed delimiter */
        /* if mismatch, see if in extensions */
        if (ret && (ext = X509_get_ext_d2i (cert,NID_subject_alt_name,NIL,NIL)) &&
            (n = sk_GENERAL_NAME_num (ext)))
            /* older versions of OpenSSL use "ia5" instead of dNSName */
            for (i = 0; ret && (i < n); i++)
                if ((name = sk_GENERAL_NAME_value (ext,i)) &&
                    (name->type = GEN_DNS) && (s = name->d.ia5->data) &&
                    ssl_compare_hostnames (host,s)) ret = NIL;
    } else ret = "Unable to locate common name in certificate";
    return ret;
}