Skip to content

Fix use of uninitialized memory and a memory leak #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
swrh wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fix use of uninitialized memory and a memory leak #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bed86cd
Fixed uninitialized memory usage in packet sending.
swrh Nov 13, 2015
5228795
Fixed a memory leak.
swrh Nov 13, 2015
83eb9e6
Avoid crash when rudp_client_close() is called.
swrh Feb 17, 2016
fea4326
Fix use of freed memory on server when peer drops.
swrh Feb 17, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,10 @@ rudp_error_t rudp_client_connect(struct rudp_client *client)

rudp_error_t rudp_client_close(struct rudp_client *client)
{
/* Avoid SEGFAULT in case rudp_client_connect() hasn't been called yet. */
if (client->peer.endpoint == NULL)
return 0;

rudp_peer_send_close_noqueue(&client->peer);

rudp_peer_deinit(&client->peer);
Expand All @@ -70,6 +74,7 @@ rudp_error_t rudp_client_close(struct rudp_client *client)

rudp_error_t rudp_client_deinit(struct rudp_client *client)
{
rudp_address_deinit(&client->address);
rudp_endpoint_deinit(&client->endpoint);
return 0;
}
Expand Down
20 changes: 16 additions & 4 deletions src/peer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,12 @@ void rudp_peer_deinit(struct rudp_peer *peer)
{
rudp_peer_reset(peer);
rudp_address_deinit(&peer->address);
ela_source_free(peer->rudp->el, peer->service_source);
peer->service_source = NULL;

/* Avoid SEGFAULT in case rudp_peer_deinit() is called more than once. */
if (peer->service_source != NULL) {
ela_source_free(peer->rudp->el, peer->service_source);
peer->service_source = NULL;
}
}

static void peer_update_rtt(struct rudp_peer *peer, rudp_time_t last_rtt)
Expand Down Expand Up @@ -334,6 +338,7 @@ rudp_error_t rudp_peer_incoming_packet(
struct rudp_peer *peer, struct rudp_packet_chain *pc)
{
const struct rudp_packet_header *header = &pc->packet->header;
struct rudp *rudp;

rudp_log_printf(peer->rudp, RUDP_LOG_IO,
"<<< incoming [%d] %s %s (%d) %04x:%04x\n",
Expand Down Expand Up @@ -395,9 +400,12 @@ rudp_error_t rudp_peer_incoming_packet(
switch ( header->command )
{
case RUDP_CMD_CLOSE:
/* Save "rudp" here because "peer" might be freed at the dropped()
* handler (server). */
rudp = peer->rudp;
peer->state = PEER_DEAD;
peer->handler->dropped(peer);
rudp_log_printf(peer->rudp, RUDP_LOG_INFO,
rudp_log_printf(rudp, RUDP_LOG_INFO,
" peer dropped\n");
return 0;

Expand Down Expand Up @@ -610,8 +618,10 @@ rudp_error_t rudp_peer_send_connect(struct rudp_peer *peer)
{
struct rudp_packet_chain *pc = rudp_packet_chain_alloc(
peer->rudp, sizeof(struct rudp_packet_conn_req));
struct rudp_packet_conn_req *conn_req = &pc->packet->conn_req;

pc->packet->header.command = RUDP_CMD_CONN_REQ;
conn_req->header.command = RUDP_CMD_CONN_REQ;
conn_req->data = 0;

peer->state = PEER_CONNECTING;

Expand Down Expand Up @@ -652,6 +662,8 @@ static void peer_send_queue(struct rudp_peer *peer)
header->opt |= RUDP_OPT_ACK;
header->reliable_ack = htons(peer->in_seq_reliable);
// peer->must_ack = 0;
} else {
header->reliable_ack = 0;
}

rudp_log_printf(peer->rudp, RUDP_LOG_IO,
Expand Down