From df2c27af320b311ff9120b0eebcf511e5d1d1d9a Mon Sep 17 00:00:00 2001
From: JacobBarthelmeh <jacob@wolfssl.com>
Date: Thu, 3 Oct 2019 08:39:18 -0700
Subject: [PATCH 1/2] check on if free'ing ctx/method back to heap hint

---
 src/internal.c     | 18 +++++++++++++++++-
 src/ssl.c          |  1 +
 wolfssl/internal.h |  3 +++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index e1413b772..236ad0c77 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -1796,7 +1796,16 @@ void SSL_CtxResourceFree(WOLFSSL_CTX* ctx)
     wolfEventQueue_Free(&ctx->event_queue);
 #endif /* HAVE_WOLF_EVENT */
 
+#ifdef WOLFSSL_STATIC_MEMORY
+    if (ctx->onHeap == 1) {
+        XFREE(ctx->method, ctx->heap, DYNAMIC_TYPE_METHOD);
+    }
+    else {
+        XFREE(ctx->method, NULL, DYNAMIC_TYPE_METHOD);
+    }
+#else
     XFREE(ctx->method, ctx->heap, DYNAMIC_TYPE_METHOD);
+#endif
     ctx->method = NULL;
     if (ctx->suites) {
         XFREE(ctx->suites, ctx->heap, DYNAMIC_TYPE_SUITES);
@@ -1920,10 +1929,17 @@ void FreeSSL_Ctx(WOLFSSL_CTX* ctx)
     wc_UnLockMutex(&ctx->countMutex);
 
     if (doFree) {
+        void* heap = ctx->heap;
         WOLFSSL_MSG("CTX ref count down to 0, doing full free");
         SSL_CtxResourceFree(ctx);
         wc_FreeMutex(&ctx->countMutex);
-        XFREE(ctx, ctx->heap, DYNAMIC_TYPE_CTX);
+#ifdef WOLFSSL_STATIC_MEMORY
+        if (ctx->onHeap == 0) {
+            heap = NULL;
+        }
+#endif
+        XFREE(ctx, heap, DYNAMIC_TYPE_CTX);
+        (void)heap; /* not used in some builds */
     }
     else {
         (void)ctx;
diff --git a/src/ssl.c b/src/ssl.c
index 51cd0964a..ab48f92de 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -1398,6 +1398,7 @@ int wolfSSL_CTX_load_static_memory(WOLFSSL_CTX** ctx, wolfSSL_method_func method
             WOLFSSL_MSG("Error creating ctx");
             return WOLFSSL_FAILURE;
         }
+        (*ctx)->onHeap = 1; /* free the memory back to heap when done */
     }
 
     /* determine what max applies too */
diff --git a/wolfssl/internal.h b/wolfssl/internal.h
index fd29d8303..52fe55e33 100644
--- a/wolfssl/internal.h
+++ b/wolfssl/internal.h
@@ -2569,6 +2569,9 @@ struct WOLFSSL_CTX {
 #endif
     Suites*     suites;           /* make dynamic, user may not need/set */
     void*       heap;             /* for user memory overrides */
+#ifdef WOLFSSL_STATIC_MEMORY
+    byte        onHeap; /* whether the ctx/method is put on heap hint */
+#endif
     byte        verifyDepth;
     byte        verifyPeer:1;
     byte        verifyNone:1;

From 82fc96b7f306bf2e33e04a2565e2d0960ab90881 Mon Sep 17 00:00:00 2001
From: Jacob Barthelmeh <jacob@wolfssl.com>
Date: Fri, 4 Oct 2019 08:44:00 +0700
Subject: [PATCH 2/2] adjust onHeap to be a bit field

---
 wolfssl/internal.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/wolfssl/internal.h b/wolfssl/internal.h
index 52fe55e33..ee3d4768b 100644
--- a/wolfssl/internal.h
+++ b/wolfssl/internal.h
@@ -2569,9 +2569,6 @@ struct WOLFSSL_CTX {
 #endif
     Suites*     suites;           /* make dynamic, user may not need/set */
     void*       heap;             /* for user memory overrides */
-#ifdef WOLFSSL_STATIC_MEMORY
-    byte        onHeap; /* whether the ctx/method is put on heap hint */
-#endif
     byte        verifyDepth;
     byte        verifyPeer:1;
     byte        verifyNone:1;
@@ -2614,6 +2611,9 @@ struct WOLFSSL_CTX {
 #ifdef HAVE_ENCRYPT_THEN_MAC
     byte        disallowEncThenMac:1;  /* Don't do Encrypt-Then-MAC */
 #endif
+#ifdef WOLFSSL_STATIC_MEMORY
+    byte        onHeap:1; /* whether the ctx/method is put on heap hint */
+#endif
 #ifdef WOLFSSL_MULTICAST
     byte        haveMcast;        /* multicast requested */
     byte        mcastID;          /* multicast group ID */