Index: src/interfaces/libpq/fe-secure.c
===================================================================
RCS file: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v
retrieving revision 1.105
diff -c -c -r1.105 fe-secure.c
*** src/interfaces/libpq/fe-secure.c	16 May 2008 18:30:53 -0000	1.105
--- src/interfaces/libpq/fe-secure.c	27 Oct 2008 19:30:32 -0000
***************
*** 148,153 ****
--- 148,154 ----
  static int	verify_cb(int ok, X509_STORE_CTX *ctx);
  static int	client_cert_cb(SSL *, X509 **, EVP_PKEY **);
  static int	init_ssl_system(PGconn *conn);
+ static void	destroy_ssl_system(void);
  static int	initialize_SSL(PGconn *);
  static void destroy_SSL(void);
  static PostgresPollingStatusType open_client_SSL(PGconn *);
***************
*** 160,165 ****
--- 161,171 ----
  static bool pq_initssllib = true;
  
  static SSL_CTX *SSL_context = NULL;
+ 
+ #ifdef ENABLE_THREAD_SAFETY
+ static int ssl_open_connections = 0;
+ #endif
+ 
  #endif
  
  /*
***************
*** 836,860 ****
  	if (pthread_mutex_lock(&init_mutex))
  		return -1;
  
! 	if (pq_initssllib && pq_lockarray == NULL)
  	{
! 		int			i;
! 
! 		CRYPTO_set_id_callback(pq_threadidcallback);
! 
! 		pq_lockarray = malloc(sizeof(pthread_mutex_t) * CRYPTO_num_locks());
! 		if (!pq_lockarray)
  		{
! 			pthread_mutex_unlock(&init_mutex);
! 			return -1;
  		}
! 		for (i = 0; i < CRYPTO_num_locks(); i++)
  		{
! 			if (pthread_mutex_init(&pq_lockarray[i], NULL))
! 				return -1;
  		}
- 
- 		CRYPTO_set_locking_callback(pq_lockingcallback);
  	}
  #endif
  	if (!SSL_context)
--- 842,876 ----
  	if (pthread_mutex_lock(&init_mutex))
  		return -1;
  
! 	if (pq_initssllib)
  	{
! 		if (pq_lockarray == NULL)
  		{
! 			int i;
! 			
! 			pq_lockarray = malloc(sizeof(pthread_mutex_t) * CRYPTO_num_locks());
! 			if (!pq_lockarray)
! 			{
! 				pthread_mutex_unlock(&init_mutex);
! 				return -1;
! 			}
! 			for (i = 0; i < CRYPTO_num_locks(); i++)
! 			{
! 				if (pthread_mutex_init(&pq_lockarray[i], NULL))
! 				{
! 					free(pq_lockarray);
! 					pq_lockarray = NULL;
! 					pthread_mutex_unlock(&init_mutex);
! 					return -1;
! 				}
! 			}
  		}
! 		
! 		if (ssl_open_connections++ == 0)
  		{
! 			CRYPTO_set_id_callback(pq_threadidcallback);
! 			CRYPTO_set_locking_callback(pq_lockingcallback);
  		}
  	}
  #endif
  	if (!SSL_context)
***************
*** 889,894 ****
--- 905,970 ----
  }
  
  /*
+  *	This function is needed because if the libpq library is unloaded
+  *	from the application, the callback functions will no longer exist when
+  *	SSL used by other parts of the system.  For this reason,
+  *	we unregister the SSL callback functions when the last libpq
+  *	connection is closed.
+  */
+ static void
+ destroy_ssl_system(void)
+ {
+ #ifdef ENABLE_THREAD_SAFETY
+ #ifndef WIN32
+ 	static pthread_mutex_t init_mutex = PTHREAD_MUTEX_INITIALIZER;
+ #else
+ 	static pthread_mutex_t init_mutex = NULL;
+ 	static long mutex_initlock = 0;
+ 
+ 	if (init_mutex == NULL)
+ 	{
+ 		while (InterlockedExchange(&mutex_initlock, 1) == 1)
+ 			 /* loop, another thread own the lock */ ;
+ 		if (init_mutex == NULL)
+ 		{
+ 			if (pthread_mutex_init(&init_mutex, NULL))
+ 				return -1;
+ 		}
+ 		InterlockedExchange(&mutex_initlock, 0);
+ 	}
+ #endif
+ 	if (pthread_mutex_lock(&init_mutex))
+ 		return;
+ 
+ 	if (pq_initssllib)
+ 	{
+ 		/*
+ 		 *	We never free pq_lockarray, which means we leak memory on
+ 		 *	repeated loading/unloading of this library.
+ 		 */
+ 
+ 		if (ssl_open_connections > 0)
+ 			--ssl_open_connections;
+ 
+ 		if (ssl_open_connections == 0)
+ 		{
+ 			/*
+ 			 *	We need to unregister the SSL callbacks on last connection
+ 			 *	close because the libpq shared library might be unloaded,
+ 			 *	and once it is, callbacks must be removed to prevent them
+ 			 *	from being called by other SSL code.
+ 			 */
+ 			CRYPTO_set_locking_callback(NULL);
+ 			CRYPTO_set_id_callback(NULL);
+ 		}
+ 	}
+ 
+ 	pthread_mutex_unlock(&init_mutex);
+ #endif
+ 	return;
+ }
+ 
+ /*
   *	Initialize global SSL context.
   */
  static int
***************
*** 958,963 ****
--- 1034,1040 ----
  static void
  destroy_SSL(void)
  {
+ 	destroy_ssl_system();
  	if (SSL_context)
  	{
  		SSL_CTX_free(SSL_context);