fix(crypto): mac_context_dtor should free MAC

[qzhuyan]

In the doc of EVP_MAC_fetch(), https://docs.openssl.org/3.0/man3/EVP_MAC

"The returned value must eventually be freed with EVP_MAC_free(3)."

This also ensures the same behaviour as in EVP_Q_mac which is used by NIF: crypto:mac/4.

note, without this fix there is no memory leak as openssl3 returns the same addr of 'mac' (for the same MAC type), the side effect is the refcnt keeps bumping but I think it still good to have this fix also consider the case where the libcrypto is used by other NIF.

update: 2nd thought, I think it may have the risk of refcnt overflow.
update: yes. it causes refcnt overflow and triggers double free.

[github-actions]

CT Test Results

  2 files   14 suites   5m 48s ⏱️
188 tests 174 ✅  14 💤 0 ❌
470 runs  331 ✅ 139 💤 0 ❌

Results for commit f2acfa0.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

• Complete CT logs (Download Logs)
• HTML Documentation (Download HTML Docs)
• Windows Installer

// Erlang/OTP Github Action Bot

[qzhuyan]

also have a drity but handy tool to reproduce the issue.
https://github.com/qzhuyan/lli/blob/main/src/lli.erl#L14

[sverker]

I pushed a commit to your branch where EVP_MAC_fetch is called once when crypto module is loaded and EVP_MAC_free called when it's unloaded.

[qzhuyan]

@sverker LGTM.

Feel free to drop my branch if you want a clean PR.

[sverker]

@qzhuyan I suggest you squash the two commits into one and set yourself as Co-authored-by: in the commit message. Then force push the branch to your github repo.

[qzhuyan]

hi, is there anything needed from my side?

[qzhuyan]

My apologies, I just found I used the wrong author's name.
corrected now.

[sverker]

@qzhuyan I forgot about this. It just missed the code freeze for OTP 28.0-rc1. My bad. I will merge it later for inclusion in 28.0-rc2.